# CVEs published 2024-10-17 157 CVEs were published on October 17, 2024: 15 critical, 65 high. Days are UTC. - [CVE-2024-49023](https://cve.now/CVE-2024-49023.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 5.9, Microsoft Edge) - [CVE-2024-43579](https://cve.now/CVE-2024-43579.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Edge) - [CVE-2024-43596](https://cve.now/CVE-2024-43596.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge) - [CVE-2024-43578](https://cve.now/CVE-2024-43578.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Edge) - [CVE-2024-43587](https://cve.now/CVE-2024-43587.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 5.9, Microsoft Edge) - [CVE-2024-43580](https://cve.now/CVE-2024-43580.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge) - [CVE-2024-43595](https://cve.now/CVE-2024-43595.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge) - [CVE-2024-43566](https://cve.now/CVE-2024-43566.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge) - [CVE-2024-10093](https://cve.now/CVE-2024-10093.md): VSO ConvertXtoDvd ConvertXtoDvd.exe uncontrolled search path (CVSS 8.5, VSO ConvertXtoDvd) - [CVE-2024-7316](https://cve.now/CVE-2024-7316.md): Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series (CVSS 5.9, Mitsubishi Electric CNC M800V Series M800VW · Mitsubish… +17) - [CVE-2024-48924](https://cve.now/CVE-2024-48924.md): MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow (CVSS 8.7, MessagePack-CSharp · MessagePack) - [CVE-2024-49248](https://cve.now/CVE-2024-49248.md): WordPress Ad Inserter plugin \<= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Spacetime Ad Inserter) - [CVE-2024-49255](https://cve.now/CVE-2024-49255.md): WordPress Da Reactions plugin \<= 5.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Daniele Alessandra Da Reactions) - [CVE-2024-49259](https://cve.now/CVE-2024-49259.md): WordPress Primary Addon for Elementor plugin \<= 1.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Primary Addon for Elementor) - [CVE-2024-49261](https://cve.now/CVE-2024-49261.md): WordPress Arkhe Blocks plugin \<= 2.23.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ryo Arkhe Blocks) - [CVE-2024-49262](https://cve.now/CVE-2024-49262.md): WordPress Country Flags for Elementor plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wepic Country Flags for Elementor) - [CVE-2024-49263](https://cve.now/CVE-2024-49263.md): WordPress My Favorites plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Takashi Matsuyama My Favorites) - [CVE-2024-49264](https://cve.now/CVE-2024-49264.md): WordPress Events Addon for Elementor plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Events Addon for Elementor) - [CVE-2024-49276](https://cve.now/CVE-2024-49276.md): WordPress Clio Grow plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cliogrow Clio Grow) - [CVE-2024-49277](https://cve.now/CVE-2024-49277.md): WordPress UltraAddons – Elementor Addons plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saiful Islam UltraAddons Elementor Lite) - [CVE-2024-49278](https://cve.now/CVE-2024-49278.md): WordPress Omnipress plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, omnipressteam Omnipress) - [CVE-2024-49279](https://cve.now/CVE-2024-49279.md): WordPress Hyperlink Group Block plugin \<= 1.17.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Daniel Floeter Hyperlink Group Block) - [CVE-2024-49280](https://cve.now/CVE-2024-49280.md): WordPress Lightbox slider -- Responsive Lightbox Gallery plugin \<= 1.10.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Weblizar - WordPress Themes & Plugin Lightbox slider – Resp…) - [CVE-2024-49281](https://cve.now/CVE-2024-49281.md): WordPress Click to Chat – WP Support All-in-One Floating Widget plugin \<= 2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ninja Team Click to Chat – WP Support All-in-One Floating W…) - [CVE-2024-49282](https://cve.now/CVE-2024-49282.md): WordPress Responsive Lightbox & Gallery plugin \<= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, dFactory Responsive Lightbox) - [CVE-2024-49283](https://cve.now/CVE-2024-49283.md): WordPress CURCY plugin \<= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VillaTheme CURCY) - [CVE-2024-49288](https://cve.now/CVE-2024-49288.md): WordPress Email Template Customizer for WooCommerce plugin \<= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, VillaTheme Email Template Customizer for WooCommerce) - [CVE-2024-49289](https://cve.now/CVE-2024-49289.md): WordPress Cooked Pro plugin \< 1.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gora Tech Cooked Pro) - [CVE-2024-49292](https://cve.now/CVE-2024-49292.md): WordPress Exclusive Addons for Elementor plugin \<= 2.7.1 - Cross-Site Scripting vulnerability (CVSS 6.5, Tim Strifler Exclusive Addons Elementor) - [CVE-2024-49295](https://cve.now/CVE-2024-49295.md): WordPress Simple Testimonials Showcase plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, PressTigers Simple Testimonials Showcase) - [CVE-2024-49296](https://cve.now/CVE-2024-49296.md): WordPress Custom Add to Cart Button Label and Link plugin \<= 1.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, JC Custom Add to Cart Button Label and Link) - [CVE-2024-49298](https://cve.now/CVE-2024-49298.md): WordPress PeproDev Ultimate Invoice plugin \<= 2.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pepro Dev. Group PeproDev Ultimate Invoice) - [CVE-2024-49301](https://cve.now/CVE-2024-49301.md): WordPress G Meta Keywords plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sinan Yorulmaz G Meta Keywords) - [CVE-2024-49302](https://cve.now/CVE-2024-49302.md): WordPress WordPress Portfolio Builder – Portfolio Gallery plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, portfoliohub WordPress Portfolio Builder – Portfolio Gallery) - [CVE-2024-49307](https://cve.now/CVE-2024-49307.md): WordPress Admin Management Xtended plugin \<= 2.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpseek Admin Management Xtended) - [CVE-2024-49308](https://cve.now/CVE-2024-49308.md): WordPress Animator – Scroll Triggered Animations plugin \<= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Toast Plugins Animator) - [CVE-2024-49309](https://cve.now/CVE-2024-49309.md): WordPress Digitally theme \<= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, omarfolghe Digitally) - [CVE-2024-49310](https://cve.now/CVE-2024-49310.md): WordPress Themesflat Addons For Elementor plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themesflat-addons-for-elementor) - [CVE-2024-49311](https://cve.now/CVE-2024-49311.md): WordPress Edwiser Bridge plugin \<= 3.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WisdmLabs Edwiser Bridge) - [CVE-2024-49316](https://cve.now/CVE-2024-49316.md): WordPress Akismet htaccess writer plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zodiac Akismet htaccess writer) - [CVE-2024-49319](https://cve.now/CVE-2024-49319.md): WordPress Awesome Contact Form7 for Elementor plugin \<= 3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, B.M. Rafiul Alam Awesome Contact Form7 for Elementor) - [CVE-2024-10099](https://cve.now/CVE-2024-10099.md): Stored XSS in comfyanonymous/comfyui (CVSS 6.1, comfyanonymous/comfyui) - [CVE-2024-7755](https://cve.now/CVE-2024-7755.md): HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials (CVSS 7.1, HMS Networks EWON FLEXY) - [CVE-2024-10101](https://cve.now/CVE-2024-10101.md): Stored XSS in binary-husky/gpt\_academic (CVSS 5.4, binary-husky/gpt\_academic) - [CVE-2024-10100](https://cve.now/CVE-2024-10100.md): Path Traversal in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic) - [CVE-2024-43997](https://cve.now/CVE-2024-43997.md): WordPress easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg plugin \<= 2.4.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, easy.jobs EasyJobs) - [CVE-2024-49220](https://cve.now/CVE-2024-49220.md): WordPress Cookie Scanner plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nikel Cookie Scanner) - [CVE-2024-49221](https://cve.now/CVE-2024-49221.md): WordPress cSlider plugin \<= 2.4.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, julian.weinert cSlider) - [CVE-2024-49223](https://cve.now/CVE-2024-49223.md): WordPress CJ Change Howdy plugin \<= 3.3.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, shibulijack CJ Change Howdy) - [CVE-2024-49229](https://cve.now/CVE-2024-49229.md): WordPress Better Author Bio plugin \<= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, arifnezami Better Author Bio) - [CVE-2024-49237](https://cve.now/CVE-2024-49237.md): WordPress Ahmeti Wp Timeline plugin \<= 5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ahmeti Wp Timeline) - [CVE-2024-49304](https://cve.now/CVE-2024-49304.md): WordPress Pinpoint Booking System plugin \<= 2.9.9.5.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.4, DOTonPAPER Pinpoint Booking System) - [CVE-2024-49313](https://cve.now/CVE-2024-49313.md): WordPress VKontakte Wall Post plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rudestan VKontakte Wall Post) - [CVE-2024-49217](https://cve.now/CVE-2024-49217.md): WordPress Adding drop down roles in registration plugin \<= 1.1 - Privilege Escalation vulnerability (CVSS 9.8, madiriaashish Adding drop down roles in registration) - [CVE-2024-49219](https://cve.now/CVE-2024-49219.md): WordPress RS-Members plugin \<= 1.0.3 - Privilege Escalation vulnerability (CVSS 8.8, themexpo RS-Members) - [CVE-2024-49322](https://cve.now/CVE-2024-49322.md): WordPress Job Board Manager for WordPress plugin \<= 1.0 - Privilege Escalation vulnerability (CVSS 9.8, CodePassenger Job Board Manager for WordPress) - [CVE-2024-47304](https://cve.now/CVE-2024-47304.md): WordPress Fluent Support plugin \<= 1.8.0 - SQL Injection vulnerability (CVSS 8.5, Shahjahan Jewel Fluent Support) - [CVE-2024-47312](https://cve.now/CVE-2024-47312.md): WordPress Classic Editor and Classic Widgets plugin \<= 1.4.1 - SQL Injection vulnerability (CVSS 8.5, WP Grim Classic Editor and Classic Widgets) - [CVE-2024-49244](https://cve.now/CVE-2024-49244.md): WordPress SV Product Import Export for WooCommerce plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 8.5, vrinsoft CSV Product Import Export for WooCommerce) - [CVE-2024-49246](https://cve.now/CVE-2024-49246.md): WordPress Ajax Rating with Custom Login plugin \<= 1.1 - SQL Injection vulnerability (CVSS 9.3, anand23 Ajax Rating with Custom Login) - [CVE-2024-49297](https://cve.now/CVE-2024-49297.md): WordPress Zoho CRM Lead Magnet plugin \<= 1.7.9.7 - SQL Injection vulnerability (CVSS 8.5, zohocrm Zoho CRM Lead Magnet) - [CVE-2024-49299](https://cve.now/CVE-2024-49299.md): WordPress Surfer plugin \<= 1.5.0.502 - SQL Injection vulnerability (CVSS 7.6, Surfer) - [CVE-2024-49305](https://cve.now/CVE-2024-49305.md): WordPress Customer Email Verification for WooCommerce plugin \<= 2.8.10 - SQL Injection vulnerability (CVSS 9.3, WPFactory Email Verification for WooCommerce) - [CVE-2024-49235](https://cve.now/CVE-2024-49235.md): WordPress Contact Forms, Live Support, CRM, Video Messages plugin \<= 1.10.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, videowhisper Contact Forms, Live Support, CRM, Video Messag…) - [CVE-2024-49284](https://cve.now/CVE-2024-49284.md): WordPress WP SendFox plugin \<= 1.3.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, BogdanFix WP SendFox) - [CVE-2024-49291](https://cve.now/CVE-2024-49291.md): WordPress Cooked Pro plugin \< 1.8.0 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, Gora Tech Cooked Pro) - [CVE-2024-49314](https://cve.now/CVE-2024-49314.md): WordPress JiangQie Free Mini Program plugin \<= 2.5.2 - Arbitrary File Upload vulnerability (CVSS 10.0, JiangQie Free Mini Program) - [CVE-2024-49285](https://cve.now/CVE-2024-49285.md): WordPress SSV MailChimp plugin \<= 3.1.5 - Local File Inclusion vulnerability (CVSS 7.5, Jeroen Berkvens SSV MailChimp) - [CVE-2024-49287](https://cve.now/CVE-2024-49287.md): WordPress PDF-Rechnungsverwaltung plugin \<= 0.0.1 - Local File Inclusion vulnerability (CVSS 7.5, mh6webentwicklung PDF-Rechnungsverwaltung) - [CVE-2024-49400](https://cve.now/CVE-2024-49400.md): Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and argum (CVSS 9.8, Meta Tacquito) - [CVE-2024-49317](https://cve.now/CVE-2024-49317.md): WordPress Point Maker plugin \<= 0.1.4 - Local File Inclusion vulnerability (CVSS 7.5, ZIPANG Point Maker) - [CVE-2024-49318](https://cve.now/CVE-2024-49318.md): WordPress My Reading Library plugin \<= 1.0 - PHP Object Injection vulnerability (CVSS 9.8, Scott My Reading Library) - [CVE-2024-49312](https://cve.now/CVE-2024-49312.md): WordPress Edwiser Bridge plugin \<= 3.0.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, WisdmLabs Edwiser Bridge) - [CVE-2024-10073](https://cve.now/CVE-2024-10073.md): flairNLP flair Mode File Loader clustering.py ClusteringModel code injection (CVSS 6.3, flairNLP flair · flair) - [CVE-2024-10072](https://cve.now/CVE-2024-10072.md): ESAFENET CDG EncryptPolicyService.java actionAddEncryptPolicyGroup sql injection (CVSS 5.3, ESAFENET CDG) - [CVE-2024-49399](https://cve.now/CVE-2024-49399.md): Missing Authentication for Critical Function in Elvaco M-Bus Metering Gateway CMe3100 (CVSS 8.7, Elvaco M-Bus Metering Gateway CMe3100) - [CVE-2024-49398](https://cve.now/CVE-2024-49398.md): Unrestricted Upload of File with Dangerous Type in Elvaco M-Bus Metering Gateway CMe3100 (CVSS 8.8, Elvaco M-Bus Metering Gateway CMe3100) - [CVE-2024-49397](https://cve.now/CVE-2024-49397.md): Cross-site Scripting in Elvaco M-Bus Metering Gateway CMe3100 (CVSS 9.2, Elvaco M-Bus Metering Gateway CMe3100) - [CVE-2024-49396](https://cve.now/CVE-2024-49396.md): Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100 (CVSS 8.7, Elvaco M-Bus Metering Gateway CMe3100) - [CVE-2024-10071](https://cve.now/CVE-2024-10071.md): ESAFENET CDG EncryptPolicyService.java actionUpdateEncryptPolicyEdit sql injection (CVSS 5.3, ESAFENET CDG) - [CVE-2024-9414](https://cve.now/CVE-2024-9414.md): Cross-site Scripting vulnerability in LCDS LAquis SCADA (CVSS 7.0, LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda…) - [CVE-2018-25104](https://cve.now/CVE-2018-25104.md): CoinGate Plugin Payment callback.php postProcess logic error (CVSS 5.3, CoinGate Plugin) - [CVE-2024-10070](https://cve.now/CVE-2024-10070.md): ESAFENET CDG PolicyPushControlAction.java actionPolicyPush sql injection (CVSS 5.3, ESAFENET CDG) - [CVE-2024-10069](https://cve.now/CVE-2024-10069.md): ESAFENET CDG MailDecryptApplicationService.java actionPassMainApplication sql injection (CVSS 5.3, ESAFENET CDG) - [CVE-2024-47459](https://cve.now/CVE-2024-47459.md): Substance3D - Sampler | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Sampler) - [CVE-2024-48920](https://cve.now/CVE-2024-48920.md): PutongOJ: unprivileged users can escalate privileges by constructing requests (CVSS 9.1, acm309 PutongOJ) - [CVE-2024-9683](https://cve.now/CVE-2024-9683.md): Quay: quay allows successful authentication with trucated version of the password (CVSS 4.8, quay · Red Hat Quay) - [CVE-2005-10003](https://cve.now/CVE-2005-10003.md): mikexstudios Xcomic os command injection (CVSS 6.3, mikexstudios Xcomic) - [CVE-2024-6333](https://cve.now/CVE-2024-6333.md): Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products (CVSS 7.2, Xerox AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 |… +13) - [CVE-2024-49315](https://cve.now/CVE-2024-49315.md): WordPress FREE DOWNLOAD MANAGER plugin \<= 1.0.0 - Arbitrary File Deletion vulnerability (CVSS 8.6, CodeFlock FREE DOWNLOAD MANAGER) - [CVE-2024-49580](https://cve.now/CVE-2024-49580.md): In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure (CVSS 5.3, JetBrains Ktor · io.ktor:ktor-client-core-jvm) - [CVE-2024-49579](https://cve.now/CVE-2024-49579.md): In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests (CVSS 8.1, JetBrains YouTrack) - [CVE-2024-48021](https://cve.now/CVE-2024-48021.md): WordPress Contact Form 7 – PayPal & Stripe Add-on plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Scott Paterson Contact Form 7 – PayPal & Stripe Add-on) - [CVE-2024-48022](https://cve.now/CVE-2024-48022.md): WordPress Shortcode For Elementor Templates plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SysBasics Shortcode For Elementor Templates) - [CVE-2024-48023](https://cve.now/CVE-2024-48023.md): WordPress Restaurant Reservations Widget plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rconnect305 Restaurant Reservations Widget) - [CVE-2024-48025](https://cve.now/CVE-2024-48025.md): WordPress Simple Baseball Scoreboard plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, dogrow Simple Baseball Scoreboard) - [CVE-2024-48032](https://cve.now/CVE-2024-48032.md): WordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin \<= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sumitsurai Featured Posts with Multiple Custom Groups) - [CVE-2024-48036](https://cve.now/CVE-2024-48036.md): WordPress SKT Blocks plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 SKT Blocks) - [CVE-2023-6729](https://cve.now/CVE-2023-6729.md): Nokia SR OS: File Access Security Vulnerability (CVSS 7.3, Nokia SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7…) - [CVE-2024-48046](https://cve.now/CVE-2024-48046.md): WordPress Contact Form by Supsystic plugin \<= 1.7.28 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Contact Form by Supsystic) - [CVE-2024-48048](https://cve.now/CVE-2024-48048.md): WordPress Wsify Widget plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, GabbyKhrmon Wsify Widget) - [CVE-2023-6728](https://cve.now/CVE-2023-6728.md): Nokia SR OS: BOF File Encryption Vulnerability (CVSS 3.3, Nokia SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7…) - [CVE-2024-48031](https://cve.now/CVE-2024-48031.md): WordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin \<= 4.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 6.5, sumitsurai Featured Posts with Multiple Custom Groups) - [CVE-2024-48037](https://cve.now/CVE-2024-48037.md): WordPress Contact Form Widget plugin \<= 1.4.2 - CSRF vulnerability (CVSS 5.4, A WP Life Contact Form Widget) - [CVE-2024-48038](https://cve.now/CVE-2024-48038.md): WordPress wp-Monalisa plugin \<= 6.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, tuxlog wp-Monalisa) - [CVE-2024-48047](https://cve.now/CVE-2024-48047.md): WordPress Linked Variation for WooCommerce plugin \<= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Razon Komar Pal Linked Variation for WooCommerce) - [CVE-2024-48043](https://cve.now/CVE-2024-48043.md): WordPress ShortPixel Image Optimizer plugin \<= 5.6.3 - SQL Injection vulnerability (CVSS 7.6, ShortPixel Image Optimizer) - [CVE-2024-48024](https://cve.now/CVE-2024-48024.md): WordPress Keep Backup Daily plugin \<= 2.1.3 - Sensitive Data Exposure vulnerability (CVSS 7.5, Fahad Mahmood Keep Backup Daily) - [CVE-2024-49320](https://cve.now/CVE-2024-49320.md): WordPress Encyclopedia / Glossary / Wiki plugin \<= 1.7.60 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dennis Encyclopedia / Glossary / Wiki) - [CVE-2024-9898](https://cve.now/CVE-2024-9898.md): Parallax Image \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode (CVSS 6.4, thehowarde Parallax Image) - [CVE-2024-45713](https://cve.now/CVE-2024-45713.md): SolarWinds Kiwi CatTools Sensitive Information Disclosure Vulnerability (CVSS 5.1, SolarWinds Kiwi CatTools) - [CVE-2024-10068](https://cve.now/CVE-2024-10068.md): OpenSight Software FlashFXP FlashFXP.exe uncontrolled search path (CVSS 8.5, OpenSight Software FlashFXP) - [CVE-2024-10025](https://cve.now/CVE-2024-10025.md): Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx (CVSS 9.1, SICK AG SICK CLV6xx · SICK AG SICK Lector6xx +1) - [CVE-2024-49386](https://cve.now/CVE-2024-49386.md): Sensitive information disclosure due to spell-jacking. (CVSS 5.7, Acronis Cyber Files) - [CVE-2024-49389](https://cve.now/CVE-2024-49389.md): Local privilege escalation due to insecure folder permissions. (CVSS 7.8, Acronis Cyber Files) - [CVE-2024-49390](https://cve.now/CVE-2024-49390.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 7.3, Acronis Cyber Files) - [CVE-2024-49391](https://cve.now/CVE-2024-49391.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis Cyber Files) - [CVE-2024-49392](https://cve.now/CVE-2024-49392.md): Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. (CVSS 5.7, Acronis Cyber Files) - [CVE-2024-9184](https://cve.now/CVE-2024-9184.md): SendPulse Free Web Push \<= 1.3.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, SendPulse Free Web Push) - [CVE-2024-8920](https://cve.now/CVE-2024-8920.md): Fonto – Custom Web Fonts Manager \<= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, vladolaru Fonto – Custom Web Fonts Manager) - [CVE-2024-3187](https://cve.now/CVE-2024-3187.md): This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions \<= 6.0.0. (CVSS 5.9, EmbedThis GoAhead) - [CVE-2024-9951](https://cve.now/CVE-2024-9951.md): Wordpress Photo Album Plus \<= 8.8.05.003 - Reflected Cross-Site Scripting (CVSS 6.1, opajaap WP Photo Album Plus) - [CVE-2024-3186](https://cve.now/CVE-2024-3186.md): CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version \<= 6.0.0) when compiled with the ME (CVSS 5.3, EmbedThis GoAhead) - [CVE-2024-3184](https://cve.now/CVE-2024-3184.md): Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME\_GOA (CVSS 5.9, EmbedThis GoAhead) - [CVE-2024-9213](https://cve.now/CVE-2024-9213.md): Persian WooCommerce SMS \<= 7.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, persianscript افزونه پیامک ووکامرس Persian WooCommerce SMS) - [CVE-2024-5429](https://cve.now/CVE-2024-5429.md): Logo Slider \< 4.1.0 - Contributor+ Stored XSS (CVSS 7.6, Logo Slider) - [CVE-2024-9351](https://cve.now/CVE-2024-9351.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation (CVSS 4.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…) - [CVE-2024-9352](https://cve.now/CVE-2024-9352.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation (CVSS 4.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…) - [CVE-2024-7417](https://cve.now/CVE-2024-7417.md): Royal Elementor Addons and Templates \<= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…) - [CVE-2024-8719](https://cve.now/CVE-2024-8719.md): Flexmls® IDX Plugin \<= 3.14.22 - Reflected Cross-Site Scripting (CVSS 6.1, Flexmls® IDX Plugin) - [CVE-2024-9347](https://cve.now/CVE-2024-9347.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.9 - Reflected Cross-Site Scripting (CVSS 6.1, wpextended The Ultimate WordPress Toolkit – WP Extended) - [CVE-2024-9263](https://cve.now/CVE-2024-9263.md): WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin \<= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover (CVSS 9.8, arraytics Timetics – Appointment Booking & Scheduling) - [CVE-2024-9863](https://cve.now/CVE-2024-9863.md): Miniorange OTP Verification with Firebase \<= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value (CVSS 9.8, cyberlord92 Miniorange OTP Verification with Firebase) - [CVE-2024-9940](https://cve.now/CVE-2024-9940.md): Calculated Fields Form \<= 5.2.45 - HTML Injection (CVSS 5.3, codepeople Calculated Fields Form) - [CVE-2024-9215](https://cve.now/CVE-2024-9215.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover (CVSS 8.8, Co-Authors, Multiple Authors and Guest Authors in an Author…) - [CVE-2024-9240](https://cve.now/CVE-2024-9240.md): ReDi Restaurant Reservation \<= 24.0902 - Reflected Cross-Site Scripting (CVSS 6.1, thecatkin ReDi Restaurant Reservation – Instant Availabilit…) - [CVE-2024-9862](https://cve.now/CVE-2024-9862.md): Miniorange OTP Verification with Firebase \<= 3.6.0 - Unauthenticated Arbitrary User Password Change (CVSS 9.8, cyberlord92 Miniorange OTP Verification with Firebase) - [CVE-2024-9861](https://cve.now/CVE-2024-9861.md): Miniorange OTP Verification with Firebase \<= 3.6.0 - Authentication Bypass (CVSS 8.1, cyberlord92 Miniorange OTP Verification with Firebase) - [CVE-2024-45767](https://cve.now/CVE-2024-45767.md): Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ( (CVSS 4.3, Dell OpenManage Enterprise) - [CVE-2024-45766](https://cve.now/CVE-2024-45766.md): Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerabil (CVSS 8.0, Dell OpenManage Enterprise) - [CVE-2023-26785](https://cve.now/CVE-2023-26785.md): MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "cre (CVSS 9.8) - [CVE-2023-39593](https://cve.now/CVE-2023-39593.md): Insecure permissions in the sys\_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated pr (CVSS 5.6) - [CVE-2024-27766](https://cve.now/CVE-2024-27766.md): An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib\_mysqludf\_sys.so function. (CVSS 5.7) - [CVE-2024-30875](https://cve.now/CVE-2024-30875.md): Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and exe (CVSS 7.1) - [CVE-2024-33453](https://cve.now/CVE-2024-33453.md): Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component. (CVSS 8.1) - [CVE-2024-48192](https://cve.now/CVE-2024-48192.md): Tenda G3 v15.01.0.5(2848\_755)\_EN was discovered to contain a hardcoded password vulnerability in /etc\_ro/shadow, which allows attackers to l (CVSS 8.0) - [CVE-2024-48629](https://cve.now/CVE-2024-48629.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress paramete (CVSS 8.0) - [CVE-2024-48630](https://cve.now/CVE-2024-48630.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress paramet (CVSS 8.0) - [CVE-2024-48631](https://cve.now/CVE-2024-48631.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in (CVSS 8.0) - [CVE-2024-48632](https://cve.now/CVE-2024-48632.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAd (CVSS 8.0) - [CVE-2024-48633](https://cve.now/CVE-2024-48633.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalP (CVSS 8.0) - [CVE-2024-48634](https://cve.now/CVE-2024-48634.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in t (CVSS 8.0) - [CVE-2024-48635](https://cve.now/CVE-2024-48635.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID param (CVSS 8.0) - [CVE-2024-48636](https://cve.now/CVE-2024-48636.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID param (CVSS 8.0) - [CVE-2024-48637](https://cve.now/CVE-2024-48637.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID param (CVSS 8.0) - [CVE-2024-48638](https://cve.now/CVE-2024-48638.md): D-Link DIR\_882\_FW130B06 and DIR\_878 DIR\_878\_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask paramet (CVSS 8.0) - [CVE-2024-49593](https://cve.now/CVE-2024-49593.md): In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor t (CVSS 5.3) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-10-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.