# CVEs published 2024-10-25

134 CVEs were published on October 25, 2024: 22 critical, 41 high. Days are UTC.

- [CVE-2024-47821](https://cve.now/CVE-2024-47821.md): pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API (CVSS 9.1, pyload · pyload-ng)
- [CVE-2024-49767](https://cve.now/CVE-2024-49767.md): Werkzeug possible resource exhaustion when parsing file data in forms (CVSS 6.9, pallets werkzeug · pallets Quart +2)
- [CVE-2024-49766](https://cve.now/CVE-2024-49766.md): Werkzeug safe\_join not safe on Windows (CVSS 6.3, pallets werkzeug · werkzeug)
- [CVE-2024-9584](https://cve.now/CVE-2024-9584.md): Image Map Pro \<= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete (CVSS 5.4, imagemappro Image Map Pro – Drag-and-drop Builder for Inter…)
- [CVE-2024-9585](https://cve.now/CVE-2024-9585.md): Image Map Pro \<= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, imagemappro Image Map Pro – Drag-and-drop Builder for Inter…)
- [CVE-2024-10387](https://cve.now/CVE-2024-10387.md): Rockwell Automation FactoryTalk ThinManager Denial-of-Service Vulnerability (CVSS 8.7, Rockwell Automation FactoryTalk ThinManager)
- [CVE-2024-10386](https://cve.now/CVE-2024-10386.md): Rockwell Automation FactoryTalk ThinManager Authentication Vulnerability (CVSS 9.3, Rockwell Automation FactoryTalk ThinManager)
- [CVE-2024-8036](https://cve.now/CVE-2024-8036.md): Unauthorized Modifications of Firmware and Configuration (CVSS 5.9, ABB Relion Protection Relays RE\_611 IEC · ABB Relion Pr… +29)
- [CVE-2024-49757](https://cve.now/CVE-2024-49757.md): Zitadel User Registration Bypass Vulnerability (CVSS 7.5, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-49753](https://cve.now/CVE-2024-49753.md): Denied Host Validation Bypass in Zitadel Actions (CVSS 5.9, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-49381](https://cve.now/CVE-2024-49381.md): Plenti arbitrary file deletion vulnerability (CVSS 7.7, plentico plenti · github.com/plentico/plenti)
- [CVE-2024-49380](https://cve.now/CVE-2024-49380.md): Plenti arbitrary file write vulnerability (CVSS 8.9, plentico plenti · github.com/plentico/plenti)
- [CVE-2024-10380](https://cve.now/CVE-2024-10380.md): SourceCodester Petrol Pump Management Software ajax\_product.php sql injection (CVSS 5.3, SourceCodester Petrol Pump Management Software)
- [CVE-2024-49378](https://cve.now/CVE-2024-49378.md): smartUp Cross-site Scripting vulnerability (CVSS 5.8, zimocode smartup)
- [CVE-2024-49376](https://cve.now/CVE-2024-49376.md): Autolab Has Misconfigured Reset Password Permissions (CVSS 7.1, Autolab)
- [CVE-2024-10381](https://cve.now/CVE-2024-10381.md): Authentication Bypass Vulnerability in Matrix Door Controller (CVSS 9.3, Matrix Comsec Matrix Door Controller Cosec Vega FAXQ)
- [CVE-2024-9991](https://cve.now/CVE-2024-9991.md): Cleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices (CVSS 7.0, Philips Lighting (Signify Innovations India) Philips Sma… +2)
- [CVE-2024-10379](https://cve.now/CVE-2024-10379.md): ESAFENET CDG DecryptApplicationService.java actionViewDecyptFile path traversal (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10378](https://cve.now/CVE-2024-10378.md): ESAFENET CDG CDGRenewApplicationService.java actionViewCDGRenewFile sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10374](https://cve.now/CVE-2024-10374.md): WP-Members \<= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem\_loginout Shortcode (CVSS 6.4, cbutlerjr WP-Members Membership Plugin)
- [CVE-2024-10377](https://cve.now/CVE-2024-10377.md): ESAFENET CDG DecryptApplicationService.java actionPassDecryptApplication1 sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10376](https://cve.now/CVE-2024-10376.md): ESAFENET CDG AutoSignService.java actionPassOrNotAutoSign sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-47483](https://cve.now/CVE-2024-47483.md): Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL (CVSS 2.9, Dell Data Lakehouse)
- [CVE-2024-47481](https://cve.now/CVE-2024-47481.md): Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. (CVSS 6.5, Dell Data Lakehouse)
- [CVE-2024-47041](https://cve.now/CVE-2024-47041.md): In valid\_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.4, Google Android)
- [CVE-2024-47035](https://cve.now/CVE-2024-47035.md): In vring\_init of external/headers/include/virtio/virtio\_ring.h, there is a possible out of bounds write due to a logic error in the code. (CVSS 7.4, Google Android)
- [CVE-2024-47034](https://cve.now/CVE-2024-47034.md): there is a possible out of bounds read due to a missing bounds check. (CVSS 5.1, Google Android)
- [CVE-2024-47033](https://cve.now/CVE-2024-47033.md): In lwis\_allocator\_free of lwis\_allocator.c, there is a possible memory corruption due to a use after free. (CVSS 7.4, Google Android)
- [CVE-2024-47031](https://cve.now/CVE-2024-47031.md): Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861. (CVSS 7.4, Google Android)
- [CVE-2024-47030](https://cve.now/CVE-2024-47030.md): Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818. (CVSS 5.1, Google Android)
- [CVE-2024-47029](https://cve.now/CVE-2024-47029.md): In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty\_shared\_memory\_manager.cc, there is a possible out of bounds read due (CVSS 5.1, Google Android)
- [CVE-2024-47028](https://cve.now/CVE-2024-47028.md): In ffu\_flash\_pack of ffu.c, there is a possible out of bounds read due to an integer overflow. (CVSS 5.1, Google Android)
- [CVE-2024-47027](https://cve.now/CVE-2024-47027.md): In sm\_mem\_compat\_get\_vmm\_obj of lib/sm/shared\_mem.c, there is a possible arbitrary physical memory access due to improper input validation. (CVSS 7.4, Google Android)
- [CVE-2024-47026](https://cve.now/CVE-2024-47026.md): In gsc\_gsa\_rescue of gsc\_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.1, Google Android)
- [CVE-2024-47025](https://cve.now/CVE-2024-47025.md): In ppmp\_protect\_buf of drm\_fw.c, there is a possible information disclosure due to a logic error in the code. (CVSS 5.1, Google Android)
- [CVE-2024-47024](https://cve.now/CVE-2024-47024.md): In vring\_size of external/headers/include/virtio/virtio\_ring.h, there is a possible out of bounds write due to an integer overflow. (CVSS 7.4, Google Android)
- [CVE-2024-47023](https://cve.now/CVE-2024-47023.md): there is a possible man-in-the-middle attack due to a logic error in the code. (CVSS 7.4, Google Android)
- [CVE-2024-47022](https://cve.now/CVE-2024-47022.md): Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656. (CVSS 5.1, Google Android)
- [CVE-2024-47021](https://cve.now/CVE-2024-47021.md): In sms\_ExtractCbLanguage of sms\_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.1, Google Android)
- [CVE-2024-47020](https://cve.now/CVE-2024-47020.md): Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ABL component, A-331966488. (CVSS 5.1, Google Android)
- [CVE-2024-47019](https://cve.now/CVE-2024-47019.md): In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-47018](https://cve.now/CVE-2024-47018.md): In pmucal\_rae\_handle\_seq\_int of flexpmu\_cal\_rae.c, there is a possible out of bounds read due to a buffer overflow. (CVSS 5.5, Google Android)
- [CVE-2024-47017](https://cve.now/CVE-2024-47017.md): In ufshc\_scsi\_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. (CVSS 7.8, Google Android)
- [CVE-2024-47016](https://cve.now/CVE-2024-47016.md): there is a possible privilege escalation due to an insecure default value. (CVSS 7.8, Google Android)
- [CVE-2024-47015](https://cve.now/CVE-2024-47015.md): In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds c (CVSS 5.5, Google Android)
- [CVE-2024-47014](https://cve.now/CVE-2024-47014.md): Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292. (CVSS 8.8, Google Android)
- [CVE-2024-47013](https://cve.now/CVE-2024-47013.md): In pmucal\_rae\_handle\_seq\_int of flexpmu\_cal\_rae.c, there is a possible arbitrary write due to uninitialized data. (CVSS 7.8, Google Android)
- [CVE-2024-47012](https://cve.now/CVE-2024-47012.md): In mm\_GetMobileIdIndexForNsUpdate of mm\_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-44101](https://cve.now/CVE-2024-44101.md): there is a possible Null Pointer Dereference (modem crash) due to improper input validation. (CVSS 7.5, Google Android)
- [CVE-2024-44100](https://cve.now/CVE-2024-44100.md): Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545. (CVSS 7.5, Google Android)
- [CVE-2024-44099](https://cve.now/CVE-2024-44099.md): There is a possible Local bypass of user interaction due to an insecure default value. (CVSS 5.5, Google Android)
- [CVE-2024-44098](https://cve.now/CVE-2024-44098.md): In lwis\_device\_event\_states\_clear\_locked of lwis\_event.c, there is a possible privilege escalation due to a double free. (CVSS 7.4, Google Android)
- [CVE-2024-8666](https://cve.now/CVE-2024-8666.md): Shoutcast Icecast HTML5 Radio Player \<= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, svnlabs Shoutcast Icecast HTML5 Radio Player)
- [CVE-2024-10112](https://cve.now/CVE-2024-10112.md): Simple News \<= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode (CVSS 6.4, mortenpeterandersen Simple News)
- [CVE-2024-10343](https://cve.now/CVE-2024-10343.md): Beek Widget Extention \<= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, beekyoshida Beek Widget Extention)
- [CVE-2024-10016](https://cve.now/CVE-2024-10016.md): File Upload Types by WPForms \<= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, jaredatch File Upload Types by WPForms)
- [CVE-2024-47158](https://cve.now/CVE-2024-47158.md): N-LINE 2.0.6 and prior versions contain a code injection vulnerability. (CVSS 7.4, NEUMANN CO.LTD. N-LINE)
- [CVE-2024-45785](https://cve.now/CVE-2024-45785.md): MUSASI version 3 contains an issue with use of client-side authentication. (CVSS 7.5, NEUMANN CO.LTD. MUSASI)
- [CVE-2024-9628](https://cve.now/CVE-2024-9628.md): WPS Telegram Chat \<= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API (CVSS 6.3, wpsolution WPS Telegram Chat)
- [CVE-2024-9630](https://cve.now/CVE-2024-9630.md): WPS Telegram Chat \<= 4.6.0 - Missing Authorization to Information Exposure (CVSS 5.4, wpsolution WPS Telegram Chat)
- [CVE-2024-9598](https://cve.now/CVE-2024-9598.md): AMP for WP – Accelerated Mobile Pages \<= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation (CVSS 8.8, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2024-10150](https://cve.now/CVE-2024-10150.md): Bamazoo – Button Generator \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode (CVSS 6.4, Bamazoo – Button Generator)
- [CVE-2024-10342](https://cve.now/CVE-2024-10342.md): League of Legends Shortcodes \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, tezzeract League of Legends Shortcodes)
- [CVE-2024-10341](https://cve.now/CVE-2024-10341.md): League of Legends Shortcodes \<= 1.0.1 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 6.5, tezzeract League of Legends Shortcodes)
- [CVE-2024-50583](https://cve.now/CVE-2024-50583.md): Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission sett (CVSS 6.3, Naver Whale browser Installer)
- [CVE-2024-9607](https://cve.now/CVE-2024-9607.md): 10Web Social Post Feed \<= 1.2.9 - Reflected Cross-Site Scripting (CVSS 6.1, 10Web Social Post Feed)
- [CVE-2024-9235](https://cve.now/CVE-2024-9235.md): Mapster WP Maps \<= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update (CVSS 8.8, Mapster WP Maps)
- [CVE-2024-10148](https://cve.now/CVE-2024-10148.md): Awesome buttons \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode (CVSS 6.4, sohelwpexpert Awesome buttons)
- [CVE-2024-10011](https://cve.now/CVE-2024-10011.md): BuddyPress \<= 14.1.0 - Authenticated (Subscriber+) Directory Traversal (CVSS 8.1, BuddyPress)
- [CVE-2024-9302](https://cve.now/CVE-2024-9302.md): App Builder – Create Native Android & iOS Apps On The Flight \<= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP (CVSS 8.1, appcheap App Builder – Create Native Android & iOS Apps On…)
- [CVE-2024-48870](https://cve.now/CVE-2024-48870.md): Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability (CVSS 6.2, Toshiba Tec e-STUDIO · Sharp Digital Full-color MFPs and Mo…)
- [CVE-2024-47801](https://cve.now/CVE-2024-47801.md): Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability (CVSS 7.4, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-47549](https://cve.now/CVE-2024-47549.md): Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP re (CVSS 7.4, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-47406](https://cve.now/CVE-2024-47406.md): Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. (CVSS 9.1, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-47005](https://cve.now/CVE-2024-47005.md): Sharp and Toshiba Tec MFPs provide configuration related APIs. (CVSS 8.1, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-45842](https://cve.now/CVE-2024-45842.md): Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. (CVSS 5.3, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-45829](https://cve.now/CVE-2024-45829.md): Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resul (CVSS 4.9, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-43424](https://cve.now/CVE-2024-43424.md): Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. (CVSS 7.5, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-42420](https://cve.now/CVE-2024-42420.md): Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and impro (CVSS 7.5, Sharp Digital Full-color MFPs and Monochrome MFPs · Toshiba…)
- [CVE-2024-9488](https://cve.now/CVE-2024-9488.md): Comments – wpDiscuz \<= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider (CVSS 9.8, advancedcoding Comments – wpDiscuz)
- [CVE-2024-9109](https://cve.now/CVE-2024-9109.md): UPS Live Rates and Access Points \<= 2.3.12 - Missing Authorization to Plugin API key reset (CVSS 4.3, octolize Shipping Live Rates and Access Points for UPS for…)
- [CVE-2024-9686](https://cve.now/CVE-2024-9686.md): Order Notification for Telegram \<= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message (CVSS 5.3, choplugins Order Notification for Telegram)
- [CVE-2024-10372](https://cve.now/CVE-2024-10372.md): chidiwilliams buzz model\_loader.py download\_model temp file (CVSS 2.0, chidiwilliams buzz)
- [CVE-2024-10371](https://cve.now/CVE-2024-10371.md): SourceCodester Payroll Management System main login buffer overflow (CVSS 5.3, SourceCodester Payroll Management System)
- [CVE-2024-10370](https://cve.now/CVE-2024-10370.md): Codezips Sales Management System addcustind.php sql injection (CVSS 6.9, Codezips Sales Management System)
- [CVE-2024-10369](https://cve.now/CVE-2024-10369.md): Codezips Sales Management System addcustcom.php sql injection (CVSS 6.9, Codezips Sales Management System)
- [CVE-2024-10368](https://cve.now/CVE-2024-10368.md): Codezips Sales Management System addstock.php sql injection (CVSS 6.9, Codezips Sales Management System)
- [CVE-2024-10355](https://cve.now/CVE-2024-10355.md): SourceCodester Petrol Pump Management Software invoice.php sql injection (CVSS 5.1, SourceCodester Petrol Pump Management Software)
- [CVE-2024-10354](https://cve.now/CVE-2024-10354.md): SourceCodester Petrol Pump Management Software print.php sql injection (CVSS 5.1, SourceCodester Petrol Pump Management Software)
- [CVE-2022-30354](https://cve.now/CVE-2022-30354.md): OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. (CVSS 7.5)
- [CVE-2022-30355](https://cve.now/CVE-2022-30355.md): OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId an (CVSS 9.8)
- [CVE-2022-30356](https://cve.now/CVE-2022-30356.md): OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid a (CVSS 8.8)
- [CVE-2022-30357](https://cve.now/CVE-2022-30357.md): OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId an (CVSS 9.8)
- [CVE-2022-30358](https://cve.now/CVE-2022-30358.md): OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and (CVSS 8.8)
- [CVE-2022-30359](https://cve.now/CVE-2022-30359.md): OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. (CVSS 5.4)
- [CVE-2022-30360](https://cve.now/CVE-2022-30360.md): OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to /profile/u (CVSS 5.4)
- [CVE-2022-30361](https://cve.now/CVE-2022-30361.md): OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. (CVSS 4.3)
- [CVE-2023-26248](https://cve.now/CVE-2023-26248.md): The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., inf (CVSS 5.3, github.com/libp2p/go-libp2p-kad-dht)
- [CVE-2024-37844](https://cve.now/CVE-2024-37844.md): A stored cross-site scripting (XSS) vulnerability in MangoOS before 5.2.0 allows attackers to execute arbitrary web scripts or HTML via a cr (CVSS 4.7)
- [CVE-2024-37845](https://cve.now/CVE-2024-37845.md): MangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Process Command fea (CVSS 7.2)
- [CVE-2024-37846](https://cve.now/CVE-2024-37846.md): MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Management Edit page. (CVSS 9.8)
- [CVE-2024-37847](https://cve.now/CVE-2024-37847.md): An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute arbitrary code via a c (CVSS 9.8)
- [CVE-2024-48204](https://cve.now/CVE-2024-48204.md): SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted (CVSS 9.8)
- [CVE-2024-48218](https://cve.now/CVE-2024-48218.md): Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list. (CVSS 9.8, funadmin/funadmin)
- [CVE-2024-48222](https://cve.now/CVE-2024-48222.md): Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit. (CVSS 9.8, funadmin/funadmin)
- [CVE-2024-48223](https://cve.now/CVE-2024-48223.md): Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist. (CVSS 9.8, funadmin/funadmin)
- [CVE-2024-48224](https://cve.now/CVE-2024-48224.md): Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile. (CVSS 7.5, funadmin/funadmin)
- [CVE-2024-48225](https://cve.now/CVE-2024-48225.md): Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile. (CVSS 9.1, funadmin/funadmin)
- [CVE-2024-48226](https://cve.now/CVE-2024-48226.md): Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield. (CVSS 9.8, funadmin/funadmin)
- [CVE-2024-48227](https://cve.now/CVE-2024-48227.md): Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS). (CVSS 7.5, funadmin/funadmin)
- [CVE-2024-48228](https://cve.now/CVE-2024-48228.md): An issue was found in funadmin 5.0.2. (CVSS 6.1, funadmin/funadmin)
- [CVE-2024-48229](https://cve.now/CVE-2024-48229.md): funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin. (CVSS 9.8, funadmin/funadmin)
- [CVE-2024-48230](https://cve.now/CVE-2024-48230.md): funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \\backend\\controller\\auth\\Auth.php. (CVSS 9.8, funadmin/funadmin)
- [CVE-2024-48232](https://cve.now/CVE-2024-48232.md): An issue was found in mipjz 5.0.5. (CVSS 4.9)
- [CVE-2024-48233](https://cve.now/CVE-2024-48233.md): mipjz 5.0.5 is vulnerable to Cross Site Scripting (XSS) in \\app\\setting\\controller\\ApiAdminSetting.php via the ICP parameter. (CVSS 4.8)
- [CVE-2024-48234](https://cve.now/CVE-2024-48234.md): An issue was discovered in mipjz 5.0.5. (CVSS 4.9)
- [CVE-2024-48235](https://cve.now/CVE-2024-48235.md): An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file. (CVSS 6.5)
- [CVE-2024-48236](https://cve.now/CVE-2024-48236.md): An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of t (CVSS 6.5)
- [CVE-2024-48237](https://cve.now/CVE-2024-48237.md): WTCMS 1.0 is vulnerable to Incorrect Access Control in \\Common\\Controller\\HomebaseController.class.php. (CVSS 9.8)
- [CVE-2024-48238](https://cve.now/CVE-2024-48238.md): WTCMS 1.0 is vulnerable to SQL Injection in the edit\_post method of /Admin\\Controller\\NavControl.class.php via the parentid parameter. (CVSS 4.7)
- [CVE-2024-48239](https://cve.now/CVE-2024-48239.md): An issue was discovered in WTCMS 1.0. (CVSS 4.8)
- [CVE-2024-48343](https://cve.now/CVE-2024-48343.md): A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSea (CVSS 6.3)
- [CVE-2024-48396](https://cve.now/CVE-2024-48396.md): AIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2024-48428](https://cve.now/CVE-2024-48428.md): An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function. (CVSS 9.8)
- [CVE-2024-48448](https://cve.now/CVE-2024-48448.md): An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML fil (CVSS 6.1)
- [CVE-2024-48450](https://cve.now/CVE-2024-48450.md): An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML fil (CVSS 6.5)
- [CVE-2024-48459](https://cve.now/CVE-2024-48459.md): A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (CVSS 7.3)
- [CVE-2024-48579](https://cve.now/CVE-2024-48579.md): SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code v (CVSS 9.8)
- [CVE-2024-48580](https://cve.now/CVE-2024-48580.md): SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email (CVSS 9.8)
- [CVE-2024-48581](https://cve.now/CVE-2024-48581.md): File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin\_cl (CVSS 9.8)
- [CVE-2024-48654](https://cve.now/CVE-2024-48654.md): Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.ph (CVSS 6.1)
- [CVE-2024-48655](https://cve.now/CVE-2024-48655.md): An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file. (CVSS 8.8)
- [CVE-2024-48700](https://cve.now/CVE-2024-48700.md): Kliqqi-CMS has a background arbitrary code execution vulnerability that attackers can exploit to implant backdoors or getShell via the edit\_ (CVSS 7.2)
- [CVE-2024-48743](https://cve.now/CVE-2024-48743.md): Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parameter. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.