# CVEs published 2024-10-27 35 CVEs were published on October 27, 2024: 1 critical, 4 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2024-10432](https://cve.now/CVE-2024-10432.md): Project Worlds Simple Web-Based Chat Application index.php sql injection (CVSS 6.9, Project Worlds Simple Web-Based Chat Application) - [CVE-2024-10431](https://cve.now/CVE-2024-10431.md): Codezips Pet Shop Management System deletebird.php sql injection (CVSS 6.9, Codezips Pet Shop Management System) - [CVE-2024-10430](https://cve.now/CVE-2024-10430.md): Codezips Pet Shop Management System animalsupdate.php sql injection (CVSS 6.9, Codezips Pet Shop Management System) - [CVE-2024-10429](https://cve.now/CVE-2024-10429.md): WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set\_ipv6 command injection (CVSS 8.6, WAVLINK WN530H4 · WAVLINK WN530HG4 +1) - [CVE-2024-10428](https://cve.now/CVE-2024-10428.md): WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set\_ipv6 command injection (CVSS 8.6, WAVLINK WN530H4 · WAVLINK WN530HG4 +1) - [CVE-2024-10427](https://cve.now/CVE-2024-10427.md): Codezips Pet Shop Management System deleteanimal.php sql injection (CVSS 5.3, Codezips Pet Shop Management System) - [CVE-2024-10426](https://cve.now/CVE-2024-10426.md): Codezips Pet Shop Management System animalsadd.php sql injection (CVSS 5.3, Codezips Pet Shop Management System) - [CVE-2024-10425](https://cve.now/CVE-2024-10425.md): Project Worlds Student Project Allocation System Project Selection Page move\_up\_project.php sql injection (CVSS 5.3, Project Worlds Student Project Allocation System) - [CVE-2024-10424](https://cve.now/CVE-2024-10424.md): Project Worlds Student Project Allocation System Project Selection Page remove\_project.php sql injection (CVSS 5.3, Project Worlds Student Project Allocation System) - [CVE-2024-10423](https://cve.now/CVE-2024-10423.md): Project Worlds Student Project Allocation System Project Selection Page project\_selection.php sql injection (CVSS 5.3, Project Worlds Student Project Allocation System) - [CVE-2024-10422](https://cve.now/CVE-2024-10422.md): SourceCodester Attendance and Payroll System overtime\_add.php sql injection (CVSS 5.3, SourceCodester Attendance and Payroll System) - [CVE-2024-10421](https://cve.now/CVE-2024-10421.md): SourceCodester Attendance and Payroll System overtime\_row.php sql injection (CVSS 5.3, SourceCodester Attendance and Payroll System) - [CVE-2024-10420](https://cve.now/CVE-2024-10420.md): SourceCodester Attendance and Payroll System update.php upload unrestricted upload (CVSS 5.3, SourceCodester Attendance and Payroll System) - [CVE-2024-10419](https://cve.now/CVE-2024-10419.md): code-projects Blood Bank Management System bloodrequest.php cross site scripting (CVSS 5.3, code-projects Blood Bank Management System) - [CVE-2024-10418](https://cve.now/CVE-2024-10418.md): code-projects Blood Bank Management System infoAdd.php sql injection (CVSS 5.3, code-projects Blood Bank Management System) - [CVE-2024-10417](https://cve.now/CVE-2024-10417.md): code-projects Blood Bank Management System delete.php sql injection (CVSS 5.3, code-projects Blood Bank Management System) - [CVE-2024-10416](https://cve.now/CVE-2024-10416.md): code-projects Blood Bank Management System cancel.php sql injection (CVSS 5.3, code-projects Blood Bank Management System) - [CVE-2024-10415](https://cve.now/CVE-2024-10415.md): code-projects Blood Bank Management System accept.php sql injection (CVSS 5.3, code-projects Blood Bank Management System) - [CVE-2024-10414](https://cve.now/CVE-2024-10414.md): PHPGurukul Vehicle Record System edit-brand.php cross site scripting (CVSS 5.1, PHPGurukul Vehicle Record System) - [CVE-2024-10413](https://cve.now/CVE-2024-10413.md): SourceCodester Online Hotel Reservation System update.php upload unrestricted upload (CVSS 5.3, SourceCodester Online Hotel Reservation System) - [CVE-2024-10412](https://cve.now/CVE-2024-10412.md): Poco-z Guns-Medical File Upload upload cross site scripting (CVSS 5.3, Poco-z Guns-Medical) - [CVE-2024-10411](https://cve.now/CVE-2024-10411.md): SourceCodester Online Hotel Reservation System controller.php doCheckout sql injection (CVSS 5.3, SourceCodester Online Hotel Reservation System) - [CVE-2024-10410](https://cve.now/CVE-2024-10410.md): SourceCodester Online Hotel Reservation System controller.php upload unrestricted upload (CVSS 5.3, SourceCodester Online Hotel Reservation System) - [CVE-2024-10409](https://cve.now/CVE-2024-10409.md): code-projects Blood Bank Management accept.php sql injection (CVSS 5.3, code-projects Blood Bank Management) - [CVE-2024-10408](https://cve.now/CVE-2024-10408.md): code-projects Blood Bank Management abs.php sql injection (CVSS 5.3, code-projects Blood Bank Management) - [CVE-2024-50602](https://cve.now/CVE-2024-50602.md): An issue was discovered in libexpat before 2.6.4. (CVSS 5.9, libpython · python +1) - [CVE-2024-50610](https://cve.now/CVE-2024-50610.md): GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl\_siman\_solve\_many in siman/siman.c. (CVSS 3.6) - [CVE-2024-50611](https://cve.now/CVE-2024-50611.md): CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as buil (CVSS 7.2, @cyclonedx/cdxgen) - [CVE-2024-50612](https://cve.now/CVE-2024-50612.md): libsndfile through 1.2.2 has an ogg\_vorbis.c vorbis\_analysis\_wrote out-of-bounds read. (CVSS 5.3) - [CVE-2024-50613](https://cve.now/CVE-2024-50613.md): libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg\_l3\_encode.c mpeg\_l3\_encoder\_close. (CVSS 6.5) - [CVE-2024-50614](https://cve.now/CVE-2024-50614.md): TinyXML2 through 10.0.0 has a reachable assertion for UINT\_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterR (CVSS 6.5) - [CVE-2024-50615](https://cve.now/CVE-2024-50615.md): TinyXML2 through 10.0.0 has a reachable assertion for UINT\_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharact (CVSS 6.5) - [CVE-2024-50616](https://cve.now/CVE-2024-50616.md): Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information. (CVSS 8.8) - [CVE-2024-50623](https://cve.now/CVE-2024-50623.md): In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download th (CVSS 9.8, KEV) - [CVE-2024-50624](https://cve.now/CVE-2024-50624.md): ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because c (CVSS 5.9) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-10-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.