# CVEs published 2024-10-16

185 CVEs were published on October 16, 2024: 33 critical, 64 high. Days are UTC.

- [CVE-2024-7994](https://cve.now/CVE-2024-7994.md): Stack-Based Buffer Overflow Vulnerability in Autodesk Revit (CVSS 7.8, Autodesk Revit)
- [CVE-2024-7993](https://cve.now/CVE-2024-7993.md): Out-of-Bounds Write Vulnerability in Autodesk Revit (CVSS 7.8, Autodesk Revit)
- [CVE-2024-48918](https://cve.now/CVE-2024-48918.md): Lack of Input Validation in RDS Light - Potential for Injection Attacks and Memory Tampering (CVSS 8.1, RDSaiPlatforms RDSlight)
- [CVE-2024-47889](https://cve.now/CVE-2024-47889.md): Action Mailer has possible ReDoS vulnerability in block\_format (CVSS 6.6, rails · actionmailer)
- [CVE-2024-47888](https://cve.now/CVE-2024-47888.md): Action Text has possible ReDoS vulnerability in plain\_text\_for\_blockquote\_node (CVSS 6.6, rails · actiontext)
- [CVE-2024-47887](https://cve.now/CVE-2024-47887.md): Action Controller has possible ReDoS vulnerability in HTTP Token authentication (CVSS 6.6, rails · actionpack)
- [CVE-2024-47836](https://cve.now/CVE-2024-47836.md): Admidio vulnerable to HTML Injection In The Messages Section (CVSS 3.5, admidio · admidio/admidio)
- [CVE-2024-47522](https://cve.now/CVE-2024-47522.md): Suricata ja4: invalid alpn leads to panic (CVSS 7.5, OISF suricata)
- [CVE-2024-47188](https://cve.now/CVE-2024-47188.md): Suricata http/byte-ranges: missing hashtable random seed leads to potential DoS (CVSS 7.5, OISF suricata)
- [CVE-2024-47187](https://cve.now/CVE-2024-47187.md): Suricata datasets: missing hashtable random seed leads to potential DoS (CVSS 7.5, OISF suricata)
- [CVE-2024-45797](https://cve.now/CVE-2024-45797.md): LibHTP's unbounded header handling leads to denial service (CVSS 7.5, OISF libhtp)
- [CVE-2024-45796](https://cve.now/CVE-2024-45796.md): Suricata defrag: off by one can lead to policy bypass (CVSS 5.3, OISF suricata)
- [CVE-2024-45795](https://cve.now/CVE-2024-45795.md): Suricata detect/datasets: reachable assertion with unimplemented rule option (CVSS 7.5, OISF suricata)
- [CVE-2024-41128](https://cve.now/CVE-2024-41128.md): Action Dispatch has possible ReDoS vulnerability in query parameter filtering (CVSS 6.6, rails · actionpack)
- [CVE-2024-9143](https://cve.now/CVE-2024-9143.md): Low-level invalid GF(2^m) parameters lead to OOB memory access (CVSS 4.3, OpenSSL)
- [CVE-2024-10033](https://cve.now/CVE-2024-10033.md): Aap-gateway: xss on aap-gateway (CVSS 6.1, aap-gateway · Red Hat Ansible Automation Platform 2.5 for R…)
- [CVE-2024-38814](https://cve.now/CVE-2024-38814.md): An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. (CVSS 8.8, VMware HCX)
- [CVE-2024-4692](https://cve.now/CVE-2024-4692.md): Multiple missing permission checks (CVSS 1.8, OpenText Application Automation Tools)
- [CVE-2024-4690](https://cve.now/CVE-2024-4690.md): Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools (CVSS 5.1, OpenText Application Automation Tools)
- [CVE-2024-4211](https://cve.now/CVE-2024-4211.md): Multiple missing permission checks (CVSS 1.8, OpenText Application Automation Tools)
- [CVE-2024-4189](https://cve.now/CVE-2024-4189.md): Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools (CVSS 5.9, OpenText Application Automation Tools)
- [CVE-2024-4184](https://cve.now/CVE-2024-4184.md): Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools (CVSS 5.9, OpenText Application Automation Tools)
- [CVE-2023-32266](https://cve.now/CVE-2023-32266.md): Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center. (CVSS 5.3, OpenText™ Application Lifecycle Management (ALM),Quality Ce…)
- [CVE-2024-45071](https://cve.now/CVE-2024-45071.md): IBM WebSphere Application Server cross-site scripting (CVSS 5.5, IBM WebSphere Application Server)
- [CVE-2024-20512](https://cve.now/CVE-2024-20512.md): Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Contact Center Management Portal)
- [CVE-2024-20463](https://cve.now/CVE-2024-20463.md): Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection and Denial of Service Vulnerability (CVSS 5.4, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20462](https://cve.now/CVE-2024-20462.md): Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability (CVSS 5.5, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20461](https://cve.now/CVE-2024-20461.md): Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection Vulnerability (CVSS 6.0, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20460](https://cve.now/CVE-2024-20460.md): Cisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20459](https://cve.now/CVE-2024-20459.md): Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Command Injection Vulnerability (CVSS 6.5, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20458](https://cve.now/CVE-2024-20458.md): Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities (CVSS 8.2, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20421](https://cve.now/CVE-2024-20421.md): Cisco ATA 190 Series Analog Telephone Adapter Firmware Cross-Site Request Forgery Vulnerability (CVSS 7.1, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20420](https://cve.now/CVE-2024-20420.md): Cisco ATA 190 Series Analog Telephone Adapter Firmware Privilege Escalation Vulnerability (CVSS 5.4, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2024-20280](https://cve.now/CVE-2024-20280.md): Cisco UCS Central Software Configuration Backup Static Key Vulnerability (CVSS 6.3, Cisco Unified Computing System Central Software)
- [CVE-2024-45072](https://cve.now/CVE-2024-45072.md): IBM WebSphere Application Server XML external entity injection (CVSS 5.5, IBM WebSphere Application Server)
- [CVE-2024-29155](https://cve.now/CVE-2024-29155.md): Denial of service on Microchip RN4870 devices (CVSS 4.3, Microchip RN4870)
- [CVE-2024-49265](https://cve.now/CVE-2024-49265.md): WordPress Booking.com Banner Creator plugin \<= 1.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SPBooking.com Booking.com Banner Creator)
- [CVE-2024-9348](https://cve.now/CVE-2024-9348.md): Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view (CVSS 8.9, Docker Desktop)
- [CVE-2024-49266](https://cve.now/CVE-2024-49266.md): WordPress WP-Spreadplugin plugin \<= 4.8.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Thimo Grauerholz WP-Spreadplugin)
- [CVE-2024-49267](https://cve.now/CVE-2024-49267.md): WordPress Unlimited Addon For Elementor plugin \<=2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nayon46 Unlimited Addon For Elementor)
- [CVE-2024-49268](https://cve.now/CVE-2024-49268.md): WordPress disconnected theme \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sunburntkamel disconnected)
- [CVE-2024-45844](https://cve.now/CVE-2024-45844.md): BIG-IP monitors vulnerability (CVSS 7.2, F5 BIG-IP)
- [CVE-2024-47139](https://cve.now/CVE-2024-47139.md): F5 BIG-IQ Vulnerability (CVSS 4.8, F5 BIG-IQ)
- [CVE-2024-9893](https://cve.now/CVE-2024-9893.md): Nextend Social Login Pro \<= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider (CVSS 9.8, nextendweb Nextend Social Login Pro)
- [CVE-2024-49270](https://cve.now/CVE-2024-49270.md): WordPress Smart Blocks plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hashthemes Smart Blocks)
- [CVE-2023-32189](https://cve.now/CVE-2023-32189.md): Insecure handling SSH key in SUSE Manager when bootstrapping new clients (CVSS 5.9, SUSE Manager Server Module)
- [CVE-2024-49252](https://cve.now/CVE-2024-49252.md): WordPress leyka plugin \<=3.31.6 - Broken Access Control vulnerability (CVSS 5.3, VaultDweller Leyka)
- [CVE-2024-49245](https://cve.now/CVE-2024-49245.md): WordPress Ahime Image Printer plugin \<= 1.0.0 - Arbitrary File Download vulnerability (CVSS 7.5, nahimsalami Ahime Image Printer)
- [CVE-2024-22034](https://cve.now/CVE-2024-22034.md): Crafted projects can overwrite special files in the .osc config directory (CVSS 5.5, SUSE Linux Enterprise Desktop 15 SP5 · SUSE Linux Enter… +13)
- [CVE-2024-49258](https://cve.now/CVE-2024-49258.md): WordPress Limb Gallery plugin \<= 1.5.7 - Arbitrary File Download vulnerability (CVSS 6.5, Limbcode WordPress Gallery Plugin – Limb Image Gallery)
- [CVE-2024-48034](https://cve.now/CVE-2024-48034.md): WordPress Creates 3D Flipbook, PDF Flipbook plugin \<= 1.2 - Arbitrary File Upload vulnerability (CVSS 9.9, fliperrr Creates 3D Flipbook, PDF Flipbook)
- [CVE-2024-22033](https://cve.now/CVE-2024-22033.md): obs-service-download\_url is vulnerable to argument injection (CVSS 6.3, SUSE Package Hub 15 SP5 · SUSE Package Hub 15 SP6 +2)
- [CVE-2024-49216](https://cve.now/CVE-2024-49216.md): WordPress Feed Comments Number plugin \<= 0.2.1 - Arbitrary File Upload vulnerability (CVSS 10.0, jclay06 Feed Comments Number)
- [CVE-2024-49242](https://cve.now/CVE-2024-49242.md): WordPress Digital Lottery plugin \<= 3.0.5 - Arbitrary File Upload vulnerability (CVSS 10.0, Shafiq Digital Lottery)
- [CVE-2024-49260](https://cve.now/CVE-2024-49260.md): WordPress Limb Gallery plugin \<= 1.5.7 - Arbitrary File Upload vulnerability (CVSS 9.9, Limbcode WordPress Gallery Plugin – Limb Image Gallery)
- [CVE-2024-47351](https://cve.now/CVE-2024-47351.md): WordPress MaxSlider plugin \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 7.5, The CSSIgniter Team MaxSlider)
- [CVE-2024-47645](https://cve.now/CVE-2024-47645.md): WordPress WPOptin plugin \<= 2.0.1 - Local File Inclusion vulnerability (CVSS 7.5, Danish Ali Malik Top Bar – PopUps – by WPOptin)
- [CVE-2024-48029](https://cve.now/CVE-2024-48029.md): WordPress SB Random Posts Widget plugin \<= 1.0 - Local File Inclusion vulnerability (CVSS 7.5, Hung Trang Si SB Random Posts Widget)
- [CVE-2024-49251](https://cve.now/CVE-2024-49251.md): WordPress Maan Addons For Elementor plugin \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 7.5, Acnoo Maan Addons For Elementor)
- [CVE-2024-22032](https://cve.now/CVE-2024-22032.md): Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec (CVSS 6.5, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-48026](https://cve.now/CVE-2024-48026.md): WordPress Disc Golf Manager plugin \<= 1.0.0 - PHP Object Injection vulnerability (CVSS 9.8, GMRobbins Disc Golf Manager)
- [CVE-2024-22030](https://cve.now/CVE-2024-22030.md): Rancher agents can be hijacked by taking over the Rancher Server URL (CVSS 8.0, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-48028](https://cve.now/CVE-2024-48028.md): WordPress IP Loc8 plugin \<= 1.1 - PHP Object Injection vulnerability (CVSS 9.8, Boyan Raichev IP Loc8)
- [CVE-2024-48030](https://cve.now/CVE-2024-48030.md): WordPress Telecash Ricaricaweb plugin \<= 2.2 - PHP Object Injection vulnerability (CVSS 9.8, Webextends Telecash Ricaricaweb)
- [CVE-2024-49218](https://cve.now/CVE-2024-49218.md): WordPress Recently plugin \<= 1.1 - PHP Object Injection vulnerability (CVSS 9.8, Al Imran Akash Recently)
- [CVE-2024-22029](https://cve.now/CVE-2024-22029.md): tomcat packaging allows for escalation to root from tomcat user (CVSS 7.8, Container suse/manager/5.0/x86\_64/server:5.0.0-beta1.2.… +21)
- [CVE-2024-49226](https://cve.now/CVE-2024-49226.md): WordPress TAKETIN To WP Membership plugin \<= 2.8.17 - PHP Object Injection vulnerability (CVSS 8.8, TAKETIN To WP Membership)
- [CVE-2024-49227](https://cve.now/CVE-2024-49227.md): WordPress Free Stock Photos Foter plugin \<= 1.5.4 - PHP Object Injection vulnerability (CVSS 8.8, Free Stock Photos Foter)
- [CVE-2024-49254](https://cve.now/CVE-2024-49254.md): WordPress ajax-extend plugin \<= 1.0 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, sunjianle ajax-extend)
- [CVE-2024-47637](https://cve.now/CVE-2024-47637.md): WordPress LiteSpeed Cache plugin \<= 6.4.1 - Path Traversal vulnerability (CVSS 8.8, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-49253](https://cve.now/CVE-2024-49253.md): WordPress Analyse Uploads plugin \<= 0.5 - Arbitrary File Deletion vulnerability (CVSS 8.6, JamesPark.ninja Analyse Uploads)
- [CVE-2024-47649](https://cve.now/CVE-2024-47649.md): WordPress Iconize plugin \<= 1.2.4 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, THATplugin Iconize)
- [CVE-2024-48027](https://cve.now/CVE-2024-48027.md): WordPress External featured image from bing plugin \<= 1.0.2 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, xaraartech External featured image from bing)
- [CVE-2024-48035](https://cve.now/CVE-2024-48035.md): WordPress ACF Images Search And Insert plugin \<= 1.1.4 - Arbitrary File Upload vulnerability (CVSS 9.9, takayukii ACF Images Search And Insert)
- [CVE-2023-32196](https://cve.now/CVE-2023-32196.md): Rancher's External RoleTemplates can lead to privilege escalation (CVSS 6.6, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-10024](https://cve.now/CVE-2024-10024.md): code-projects Pharmacy Management System manage\_medicine\_stock.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-10023](https://cve.now/CVE-2024-10023.md): code-projects Pharmacy Management System add\_new\_medicine.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-48042](https://cve.now/CVE-2024-48042.md): WordPress Contact Form by Supsystic plugin \<= 1.7.28 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Contact Form by Supsystic)
- [CVE-2024-49257](https://cve.now/CVE-2024-49257.md): WordPress Azz Anonim Posting plugin \<= 0.9 - Arbitrary File Upload vulnerability (CVSS 10.0, Denis Azz Anonim Posting)
- [CVE-2023-32194](https://cve.now/CVE-2023-32194.md): Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' (CVSS 7.2, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-49271](https://cve.now/CVE-2024-49271.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 1.5.121 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Unlimited Elements For Elementor)
- [CVE-2020-36841](https://cve.now/CVE-2020-36841.md): WooCommerce Smart Coupons \<= 4.6.0 - Unauthenticated Coupon Creation (CVSS 5.3, WooCommerce Smart Coupons)
- [CVE-2024-49247](https://cve.now/CVE-2024-49247.md): WordPress BuddyPress Better Registration plugin \<= 1.6 - Broken Authentication vulnerability (CVSS 9.8, SK BuddyPress Better Registration)
- [CVE-2023-32193](https://cve.now/CVE-2023-32193.md): Norman API Cross-site Scripting Vulnerability (CVSS 8.3, SUSE norman · github.com/rancher/norman)
- [CVE-2023-32192](https://cve.now/CVE-2023-32192.md): Rancher API Server Cross-site Scripting Vulnerability (CVSS 8.3, SUSE apiserver · github.com/rancher/apiserver)
- [CVE-2023-32191](https://cve.now/CVE-2023-32191.md): rke's credentials are stored in the RKE1 Cluster state ConfigMap (CVSS 9.9, SUSE rke · github.com/rancher/rke)
- [CVE-2023-32190](https://cve.now/CVE-2023-32190.md): mlocate's %post script allows RUN\_UPDATEDB\_AS user to make arbitrary files world readable (CVSS 8.5, openSUSE Tumbleweed)
- [CVE-2024-10022](https://cve.now/CVE-2024-10022.md): code-projects Pharmacy Management System manage\_supplier.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-10021](https://cve.now/CVE-2024-10021.md): code-projects Pharmacy Management System manage\_purchase.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-8040](https://cve.now/CVE-2024-8040.md): Authorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x (CVSS 7.7, Dassault Systèmes 3DSwymer)
- [CVE-2024-6380](https://cve.now/CVE-2024-6380.md): Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-8921](https://cve.now/CVE-2024-8921.md): Zita Elementor Site Library \<= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpzita Zita Site Library for Elementor)
- [CVE-2024-9444](https://cve.now/CVE-2024-9444.md): ElementsReady Addons for Elementor \<= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-9858](https://cve.now/CVE-2024-9858.md): Insecure user permissions in Google Cloud Migrate to Containers for Windows (CVSS 5.9, Google Cloud Migrate to Containers)
- [CVE-2023-32188](https://cve.now/CVE-2023-32188.md): JWT token compromise can allow malicious actions including Remote Code Execution (RCE) (CVSS 9.4, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2023-22650](https://cve.now/CVE-2023-22650.md): Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider (CVSS 8.8, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-45219](https://cve.now/CVE-2024-45219.md): Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure (CVSS 8.5, Apache Software Foundation Apache CloudStack)
- [CVE-2024-45461](https://cve.now/CVE-2024-45461.md): Apache CloudStack Quota plugin: Access checks not enforced in Quota (CVSS 5.7, Apache Software Foundation Apache CloudStack Quota plugin)
- [CVE-2024-45462](https://cve.now/CVE-2024-45462.md): Apache CloudStack: Incomplete session invalidation on web interface logout (CVSS 6.3, Apache Software Foundation Apache CloudStack)
- [CVE-2024-45693](https://cve.now/CVE-2024-45693.md): Apache CloudStack: Request origin validation bypass makes account takeover possible (CVSS 8.0, Apache Software Foundation Apache CloudStack)
- [CVE-2024-45217](https://cve.now/CVE-2024-45217.md): Apache Solr: ConfigSets created during a backup restore command are trusted implicitly (CVSS 8.1, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2024-45216](https://cve.now/CVE-2024-45216.md): Apache Solr: Authentication bypass possible using a fake URL Path ending (CVSS 9.8, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2023-22649](https://cve.now/CVE-2023-22649.md): Rancher 'Audit Log' leaks sensitive information (CVSS 8.4, SUSE rancher · github.com/rancher/rancher)
- [CVE-2020-36842](https://cve.now/CVE-2020-36842.md): Migration, Backup, Staging – WPvivid \<= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2023-7295](https://cve.now/CVE-2023-7295.md): Video Grid \<= 1.21 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Video Grid)
- [CVE-2017-20194](https://cve.now/CVE-2017-20194.md): Formidable Form Builder \< 2.05.03 - Unauthenticated Information Disclosure (CVSS 5.3, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2024-9540](https://cve.now/CVE-2024-9540.md): Sina Extension for Elementor \<= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template (CVSS 4.3, shaonsina Sina Extension for Elementor)
- [CVE-2021-4452](https://cve.now/CVE-2021-4452.md): Google Language Translator \<= 6.0.9 - Reflected Cross-Site Scripting (CVSS 7.1, edo888 Translate WordPress – Google Language Translator)
- [CVE-2017-20193](https://cve.now/CVE-2017-20193.md): Product Vendors \<= 2.0.35 - Reflected Cross Site Scripting (CVSS 4.7, WooCommerce Product Vendors)
- [CVE-2020-36840](https://cve.now/CVE-2020-36840.md): Timetable and Event Schedule by MotoPress \<= 2.3.8 - Missing Authorization (CVSS 7.3, jetmonsters Timetable and Event Schedule by MotoPress)
- [CVE-2023-7296](https://cve.now/CVE-2023-7296.md): BigBlueButton \<= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, blindsidenetworks BigBlueButton)
- [CVE-2016-15042](https://cve.now/CVE-2016-15042.md): Frontend File Manager \< 4.0 & N-Media Post Front-end Form \< 1.1 & - Arbitrary File Upload (CVSS 9.8, nmedia N-Media Post Front-end Form · nmedia Frontend File M…)
- [CVE-2024-9061](https://cve.now/CVE-2024-9061.md): WP Popup Builder – Popup Forms and Marketing Lead Generation \<= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp\_ajax\_nopriv\_shortcode\_Api\_Add (CVSS 7.3, themehunk WP Popup Builder – Popup Forms and Marketing Lead…)
- [CVE-2024-45711](https://cve.now/CVE-2024-45711.md): SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability (CVSS 7.5, SolarWinds Serv-U)
- [CVE-2024-45714](https://cve.now/CVE-2024-45714.md): SolarWinds Serv-U Stored XSS Vulnerability (CVSS 4.8, SolarWinds Serv-U)
- [CVE-2024-45715](https://cve.now/CVE-2024-45715.md): SolarWinds Platform Edit Function Cross-Site Scripting Vulnerability (CVSS 7.1, SolarWinds Platform)
- [CVE-2024-45710](https://cve.now/CVE-2024-45710.md): SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, SolarWinds Platform)
- [CVE-2023-7294](https://cve.now/CVE-2023-7294.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'create\_mollie\_profile' (CVSS 7.1, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2023-7293](https://cve.now/CVE-2023-7293.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'check\_mollie\_account\_details' (CVSS 4.3, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2023-7292](https://cve.now/CVE-2023-7292.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'paytium\_notice\_dismiss' (CVSS 4.3, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2020-36839](https://cve.now/CVE-2020-36839.md): WP Lead Plus X \<= 0.99 - Cross-Site Request Forgery (CVSS 8.3, bc2018 WordPress Landing Page – Squeeze Page – Responsive L…)
- [CVE-2024-8507](https://cve.now/CVE-2024-8507.md): File Manager Pro \<= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, File Manager Pro)
- [CVE-2019-25216](https://cve.now/CVE-2019-25216.md): Rich Reviews \<= 1.7.4 - Stored Cross-Site Scripting (CVSS 7.2, starfishwp Rich Reviews by Starfish)
- [CVE-2023-7291](https://cve.now/CVE-2023-7291.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'create\_mollie\_account' (CVSS 7.1, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2019-25214](https://cve.now/CVE-2019-25214.md): ShopWP \<= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting (CVSS 7.2, andrewmrobbins ShopWP)
- [CVE-2021-4445](https://cve.now/CVE-2021-4445.md): Premium Addons for Elementor \<= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update (CVSS 6.5, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2021-4447](https://cve.now/CVE-2021-4447.md): Essential Addons for Elementor \<= 4.6.4 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2022-4973](https://cve.now/CVE-2022-4973.md): WordPress Core \< 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the\_meta(); function (CVSS 4.9, WordPress Foundation WordPress)
- [CVE-2023-7290](https://cve.now/CVE-2023-7290.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'check\_for\_verified\_profiles' (CVSS 4.3, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2020-36833](https://cve.now/CVE-2020-36833.md): Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks (CVSS 6.3, wpindeed Indeed Membership Pro)
- [CVE-2016-15041](https://cve.now/CVE-2016-15041.md): MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin \<= 3.1.2 - Stored Cross-Site Scripting (CVSS 7.2, MainWP Dashboard: Self-hosted WordPress Management for Agen…)
- [CVE-2023-7289](https://cve.now/CVE-2023-7289.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'paytium\_sw\_save\_api\_keys' (CVSS 5.4, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2022-4972](https://cve.now/CVE-2022-4972.md): Download Monitor \<= 4.7.51 - Missing Authorization to Unauthenticated Data Export (CVSS 7.5, wpchill Download Monitor)
- [CVE-2018-25105](https://cve.now/CVE-2018-25105.md): File Manager \<= 3.0 - Unauthenticated Arbitrary File Upload/Download (CVSS 9.8, mndpsingh287 File Manager)
- [CVE-2020-36832](https://cve.now/CVE-2020-36832.md): Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass (CVSS 9.8, wpindeed Indeed Membership Pro)
- [CVE-2021-4450](https://cve.now/CVE-2021-4450.md): Post Grid \<= 2.1.12 - Contributor+ SQL Injection (CVSS 8.8, pickplugins Post Grid)
- [CVE-2024-9582](https://cve.now/CVE-2024-9582.md): Accordion Slider \<= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute (CVSS 6.4, bqworks Accordion Slider)
- [CVE-2020-36835](https://cve.now/CVE-2020-36835.md): Migration, Backup, Staging – WPvivid \<= 0.9.35 - Sensitive Information Disclosure (CVSS 4.9, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2017-20192](https://cve.now/CVE-2017-20192.md): Formidable Form Builder \< 2.05.03 - Unauthenticated Stored Cross-Site Scripting (CVSS 8.3, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2020-36837](https://cve.now/CVE-2020-36837.md): ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset (CVSS 9.9, ThemeGrill Demo Importer)
- [CVE-2024-8746](https://cve.now/CVE-2024-8746.md): File Manager Pro \<= 8.3.9 - Unauthenticated Backup File Download and Upload (CVSS 7.5, File Manager Pro)
- [CVE-2022-4971](https://cve.now/CVE-2022-4971.md): Sassy Social Share \<= 3.3.3 - Reflected Cross-Site Scripting (CVSS 6.1, heateor Social Sharing Plugin – Sassy Social Share)
- [CVE-2020-36836](https://cve.now/CVE-2020-36836.md): WP Fastest Cache \<= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.0, emrevona WP Fastest Cache – WordPress Cache Plugin)
- [CVE-2019-25215](https://cve.now/CVE-2019-25215.md): ARI-Adminer \<= 1.1.14 - Missing Authorization and No Direct File Access Restrictions (CVSS 7.3, arisoft ARI Adminer – WordPress Database Manager)
- [CVE-2019-25217](https://cve.now/CVE-2019-25217.md): SiteGround Optimizer \<= 5.0.12 - Missing Authorization (CVSS 9.8, siteground Speed Optimizer – The All-In-One Performance-Boo…)
- [CVE-2012-10018](https://cve.now/CVE-2012-10018.md): Mapplic Lite and Mapplic \<= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting (CVSS 8.3, sekler Mapplic Lite · sekler Mapplic - Custom Interactive M…)
- [CVE-2023-7286](https://cve.now/CVE-2023-7286.md): ACF Quick Edit Fields \<= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference (CVSS 6.5, podpirate ACF Quick Edit Fields)
- [CVE-2019-25213](https://cve.now/CVE-2019-25213.md): Advanced Access Manager \<= 5.9.8.1 - Unauthenticated Arbitrary File Read (CVSS 9.8, vasyltech Advanced Access Manager – Access Governance for W…)
- [CVE-2016-15040](https://cve.now/CVE-2016-15040.md): Kento Post View Counter \<= 2.8 - SQL Injection (CVSS 9.8, Kento Post View Counter)
- [CVE-2021-4448](https://cve.now/CVE-2021-4448.md): Kaswara Modern VC Addons \<= 3.0.1 - Missing Authorization (CVSS 7.3, SayenThemes Kaswara Modern VC Addons)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3, dashlabsltd YASR – Yet Another Star Rating Plugin for… +614)
- [CVE-2020-36831](https://cve.now/CVE-2020-36831.md): NextScripts: Social Networks Auto-Poster \<= 4.3.17 - Missing Authorization (CVSS 5.0, NextScripts: Social Networks Auto-Poster)
- [CVE-2020-36838](https://cve.now/CVE-2020-36838.md): Facebook Chat Plugin \<= 1.5 - Missing Capabilities Check (CVSS 7.4, Facebook Chat Plugin – Live Chat Plugin for WordPress)
- [CVE-2020-36834](https://cve.now/CVE-2020-36834.md): Discount Rules for WooCommerce \<= 2.0.2 - Missing Authorization (CVSS 6.3, flycart Discount Rules for WooCommerce)
- [CVE-2021-4444](https://cve.now/CVE-2021-4444.md): Product Filter by WooBeWoo \<= 1.4.9 - Missing Authorization (CVSS 7.3, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2023-7288](https://cve.now/CVE-2023-7288.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'update\_profile\_preference' (CVSS 5.4, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2021-4446](https://cve.now/CVE-2021-4446.md): Essential Addons for Elementor \<= 4.6.4 - Missing Authorization (CVSS 6.3, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2021-4449](https://cve.now/CVE-2021-4449.md): ZoomSounds \<= 5.96 - Unauthenticated Arbitrary File Upload (CVSS 9.8, ZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…)
- [CVE-2021-4451](https://cve.now/CVE-2021-4451.md): NinjaFirewall \<= 4.3.3 - Authenticated PHAR Deserialization (CVSS 6.6, nintechnet NinjaFirewall (WP Edition) – Advanced Security P…)
- [CVE-2023-7287](https://cve.now/CVE-2023-7287.md): Paytium: Mollie payment forms & donations \<= 4.3.7 - Missing Authorization in 'pt\_cancel\_subscription' (CVSS 5.4, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2021-4443](https://cve.now/CVE-2021-4443.md): WordPress Mega Menu \<= 2.0.6 - Arbitrary File Creation (CVSS 9.8, quadlayers QuadMenu – Mega Menu)
- [CVE-2024-8918](https://cve.now/CVE-2024-8918.md): File Manager Pro \<= 8.3.9 - Unauthenticated Limited JavaScript File Upload (CVSS 7.4, File Manager Pro)
- [CVE-2024-9937](https://cve.now/CVE-2024-9937.md): Woo Manage Fraud Orders \<= 2.6.1 - Reflected Cross-Site Scripting (CVSS 6.1, prasidhda Woo Manage Fraud Orders)
- [CVE-2024-9888](https://cve.now/CVE-2024-9888.md): ElementInvader Addons for Elementor \<= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, ElementInvader Addons for Elementor)
- [CVE-2024-9873](https://cve.now/CVE-2024-9873.md): Community by PeepSo \<= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, Community by PeepSo – Download from PeepSo.com)
- [CVE-2024-10018](https://cve.now/CVE-2024-10018.md): Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component. (CVSS 9.8, TECNO com.transsion.aivoiceassistant)
- [CVE-2024-9105](https://cve.now/CVE-2024-9105.md): UltimateAI \<= 2.8.3 - Authentication Bypass (CVSS 9.8, Tophive Ultimate AI)
- [CVE-2024-9634](https://cve.now/CVE-2024-9634.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 9.8, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-9647](https://cve.now/CVE-2024-9647.md): Kama SpamBlock \<= 1.8.2 - Reflected Cross-Site Scripting (CVSS 6.1, tkama Kama SpamBlock)
- [CVE-2024-9652](https://cve.now/CVE-2024-9652.md): Locatoraid Store Locator \<= 3.9.47 - Reflected Cross-Site Scripting (CVSS 6.1, plainware Locatoraid Store Locator)
- [CVE-2024-9891](https://cve.now/CVE-2024-9891.md): Multiline files upload for contact form 7 \<= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation (CVSS 4.3, zluck MultiLine Files for Contact Form)
- [CVE-2024-9305](https://cve.now/CVE-2024-9305.md): AppPresser – Mobile App Framework \<= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP (CVSS 8.1, scottopolis AppPresser – Mobile App Framework)
- [CVE-2024-9649](https://cve.now/CVE-2024-9649.md): WP ULike \<= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion (CVSS 4.3, alimir WP ULike – Like & Dislike Buttons for Engagement and…)
- [CVE-2024-9104](https://cve.now/CVE-2024-9104.md): UltimateAI \<= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check (CVSS 5.6, Tophive Ultimate AI)
- [CVE-2024-8787](https://cve.now/CVE-2024-8787.md): Smart Online Order for Clover \<= 1.5.7 - Reflected Cross-Site Scripting (CVSS 6.1, elbanyaoui Smart Online Order for Clover)
- [CVE-2024-8541](https://cve.now/CVE-2024-8541.md): Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons \<= 2.6.5 - Reflected Cross-Site Scripting (CVSS 4.7, flycart Discount Rules for WooCommerce)
- [CVE-2024-9521](https://cve.now/CVE-2024-9521.md): SEO Manager \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (CVSS 6.4, india-web-developer SEO Manager)
- [CVE-2024-44762](https://cve.now/CVE-2024-44762.md): A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. (CVSS 5.3)
- [CVE-2024-46212](https://cve.now/CVE-2024-46212.md): An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal. (CVSS 4.9, redaxo/source)
- [CVE-2024-46213](https://cve.now/CVE-2024-46213.md): REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability. (CVSS 7.2)
- [CVE-2024-46605](https://cve.now/CVE-2024-46605.md): A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary we (CVSS 6.1)
- [CVE-2024-46606](https://cve.now/CVE-2024-46606.md): A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary we (CVSS 5.4)
- [CVE-2024-48180](https://cve.now/CVE-2024-48180.md): ClassCMS \<=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/te (CVSS 9.8)
- [CVE-2024-48744](https://cve.now/CVE-2024-48744.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System (CVSS 6.1)
- [CVE-2024-48758](https://cve.now/CVE-2024-48758.md): dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.