# CVEs published 2024-11-08

121 CVEs were published on November 8, 2024: 13 critical, 45 high. Days are UTC.

- [CVE-2024-52007](https://cve.now/CVE-2024-52007.md): XXE vulnerability in XSLT parsing in \`org.hl7.fhir.core\` (CVSS 8.6, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +5)
- [CVE-2024-52009](https://cve.now/CVE-2024-52009.md): Git credentials are exposed in atlantis logs (CVSS 8.5, runatlantis atlantis · github.com/runatlantis/atlantis)
- [CVE-2024-52000](https://cve.now/CVE-2024-52000.md): Reflected Cross-site Scripting exploit in Combodo iTop (CVSS 8.1, Combodo iTop)
- [CVE-2024-52001](https://cve.now/CVE-2024-52001.md): Portal user is able to access forbidden services information in Combodo iTop (CVSS 4.3, Combodo iTop)
- [CVE-2024-52002](https://cve.now/CVE-2024-52002.md): Cross-Site Request Forgery (CSRF) in several iTop pages (CVSS 7.6, Combodo iTop)
- [CVE-2024-52004](https://cve.now/CVE-2024-52004.md): Remote code execution vulnerabilities in MediaCMS (CVSS 8.7, mediacms-io mediacms)
- [CVE-2024-11026](https://cve.now/CVE-2024-11026.md): Intelligent Apps Freenow App Keystore SSL.java hard-coded password (CVSS 6.3, Intelligent Apps Freenow App)
- [CVE-2024-21994](https://cve.now/CVE-2024-21994.md): CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 4.3, NetApp StorageGRID)
- [CVE-2024-51997](https://cve.now/CVE-2024-51997.md): The Attestation Results Token can be arbitrarily modified without being detected in Trustee (CVSS 8.1, confidential-containers trustee)
- [CVE-2024-9841](https://cve.now/CVE-2024-9841.md): OpenText ArcSight Management Center and ArcSight Platform Stored XSS (CVSS 7.0, OpenText ArcSight Management Center · OpenText ArcSight Pla…)
- [CVE-2024-45763](https://cve.now/CVE-2024-45763.md): Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comm (CVSS 9.1, Dell Enterprise SONiC OS)
- [CVE-2024-45764](https://cve.now/CVE-2024-45764.md): Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. (CVSS 9.0, Dell Enterprise SONiC OS)
- [CVE-2024-45765](https://cve.now/CVE-2024-45765.md): Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comm (CVSS 9.1, Dell Enterprise SONiC OS)
- [CVE-2024-50378](https://cve.now/CVE-2024-50378.md): Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli (CVSS 4.9, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-50592](https://cve.now/CVE-2024-50592.md): Local Privilege Escalation via Race Condition (CVSS 7.0, HASOMED Elefant Software Updater)
- [CVE-2024-50593](https://cve.now/CVE-2024-50593.md): Hardcoded Service Password (CVSS 7.8, HASOMED Elefant)
- [CVE-2024-50591](https://cve.now/CVE-2024-50591.md): Local Privilege Escalation via Command Injection (CVSS 7.8, HASOMED Elefant Software Updater)
- [CVE-2024-50590](https://cve.now/CVE-2024-50590.md): Local Privilege Escalation via Weak Service Binary Permissions (CVSS 7.8, HASOMED Elefant)
- [CVE-2024-50589](https://cve.now/CVE-2024-50589.md): Unprotected FHIR API (CVSS 7.5, HASOMED Elefant)
- [CVE-2024-10325](https://cve.now/CVE-2024-10325.md): Elementor Header & Footer Builder \<= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-10839](https://cve.now/CVE-2024-10839.md): XML External Entity (CVSS 8.5, ManageEngine SharePoint Manager Plus)
- [CVE-2024-10187](https://cve.now/CVE-2024-10187.md): myCred \<= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred\_link Shortcode (CVSS 6.4, saadiqbal Points Management System For Gamification, Ranks,…)
- [CVE-2024-50588](https://cve.now/CVE-2024-50588.md): Unprotected Exposed Firebird Database with default credentials (CVSS 9.8, HASOMED Elefant)
- [CVE-2024-24409](https://cve.now/CVE-2024-24409.md): Privilege Escalation (CVSS 8.8, ManageEngine ADManager Plus)
- [CVE-2024-11000](https://cve.now/CVE-2024-11000.md): CodeAstro Real Estate Management System About Us Page aboutedit.php unrestricted upload (CVSS 5.1, CodeAstro Real Estate Management System)
- [CVE-2024-10999](https://cve.now/CVE-2024-10999.md): CodeAstro Real Estate Management System About Us Page aboutadd.php unrestricted upload (CVSS 5.1, CodeAstro Real Estate Management System)
- [CVE-2024-10998](https://cve.now/CVE-2024-10998.md): 1000 Projects Bookstore Management System process\_category\_add.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-10997](https://cve.now/CVE-2024-10997.md): 1000 Projects Bookstore Management System book\_list.php sql injection (CVSS 5.3, 1000 Projects Bookstore Management System)
- [CVE-2024-10269](https://cve.now/CVE-2024-10269.md): Easy SVG Support \<= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, benjamin\_zekavica Easy SVG Support)
- [CVE-2024-10996](https://cve.now/CVE-2024-10996.md): 1000 Projects Bookstore Management System process\_category\_edit.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-10995](https://cve.now/CVE-2024-10995.md): Codezips Hospital Appointment System removeDoctorResult.php sql injection (CVSS 6.9, Codezips Hospital Appointment System)
- [CVE-2024-50211](https://cve.now/CVE-2024-50211.md): udf: refactor inode\_bmap() to handle error (CVSS 7.8, Linux)
- [CVE-2024-50210](https://cve.now/CVE-2024-50210.md): posix-clock: posix-clock: Fix unbalanced locking in pc\_clock\_settime() (CVSS 5.5, Linux)
- [CVE-2024-50209](https://cve.now/CVE-2024-50209.md): RDMA/bnxt\_re: Add a check for memory allocation (CVSS 7.8, Linux)
- [CVE-2024-50208](https://cve.now/CVE-2024-50208.md): RDMA/bnxt\_re: Fix a bug while setting up Level-2 PBL pages (CVSS 7.8, Linux)
- [CVE-2024-50207](https://cve.now/CVE-2024-50207.md): ring-buffer: Fix reader locking when changing the sub buffer order (CVSS 7.8, Linux)
- [CVE-2024-50206](https://cve.now/CVE-2024-50206.md): net: ethernet: mtk\_eth\_soc: fix memory corruption during fq dma init (CVSS 9.8, Linux)
- [CVE-2024-50205](https://cve.now/CVE-2024-50205.md): ALSA: firewire-lib: Avoid division by zero in apply\_constraint\_to\_size() (CVSS 5.5, Linux)
- [CVE-2024-50204](https://cve.now/CVE-2024-50204.md): fs: don't try and remove empty rbtree node (CVSS 5.5, Linux)
- [CVE-2024-50203](https://cve.now/CVE-2024-50203.md): bpf, arm64: Fix address emission with tag-based KASAN enabled (CVSS 7.8, Linux)
- [CVE-2024-10994](https://cve.now/CVE-2024-10994.md): Codezips Online Institute Management System edit\_user.php unrestricted upload (CVSS 5.3, Codezips Online Institute Management System)
- [CVE-2024-7982](https://cve.now/CVE-2024-7982.md): Registrations for The Events Calendar \< 2.12.4 - Unauthenticated Stored XSS (CVSS 9.6, Registrations for the Events Calendar)
- [CVE-2024-50202](https://cve.now/CVE-2024-50202.md): nilfs2: propagate directory read errors from nilfs\_find\_entry() (CVSS 5.5, Linux)
- [CVE-2024-50201](https://cve.now/CVE-2024-50201.md): drm/radeon: Fix encoder-\>possible\_clones (CVSS 5.5, Linux)
- [CVE-2024-50200](https://cve.now/CVE-2024-50200.md): maple\_tree: correct tree corruption on spanning store (CVSS 7.8, Linux)
- [CVE-2024-50199](https://cve.now/CVE-2024-50199.md): mm/swapfile: skip HugeTLB pages for unuse\_vma (no CVSS, Linux)
- [CVE-2024-50198](https://cve.now/CVE-2024-50198.md): iio: light: veml6030: fix IIO device retrieval from embedded device (CVSS 5.5, Linux)
- [CVE-2024-50197](https://cve.now/CVE-2024-50197.md): pinctrl: intel: platform: fix error path in device\_for\_each\_child\_node() (CVSS 5.5, Linux)
- [CVE-2024-50196](https://cve.now/CVE-2024-50196.md): pinctrl: ocelot: fix system hang on level based interrupts (CVSS 5.5, Linux)
- [CVE-2024-50195](https://cve.now/CVE-2024-50195.md): posix-clock: Fix missing timespec64 check in pc\_clock\_settime() (CVSS 7.1, Linux)
- [CVE-2024-50194](https://cve.now/CVE-2024-50194.md): arm64: probes: Fix uprobes for big-endian kernels (CVSS 5.5, Linux)
- [CVE-2024-50193](https://cve.now/CVE-2024-50193.md): x86/entry\_32: Clear CPU buffers after register restore in NMI return (CVSS 7.1, Linux)
- [CVE-2024-50192](https://cve.now/CVE-2024-50192.md): irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVSS 4.7, Linux)
- [CVE-2024-50191](https://cve.now/CVE-2024-50191.md): ext4: don't set SB\_RDONLY after filesystem errors (CVSS 5.5, Linux)
- [CVE-2024-50190](https://cve.now/CVE-2024-50190.md): ice: fix memleak in ice\_init\_tx\_topology() (CVSS 5.5, Linux)
- [CVE-2024-50189](https://cve.now/CVE-2024-50189.md): HID: amd\_sfh: Switch to device-managed dmam\_alloc\_coherent() (CVSS 7.8, Linux)
- [CVE-2024-50188](https://cve.now/CVE-2024-50188.md): net: phy: dp83869: fix memory corruption when enabling fiber (CVSS 7.8, Linux)
- [CVE-2024-50187](https://cve.now/CVE-2024-50187.md): drm/vc4: Stop the active perfmon before being destroyed (CVSS 7.8, Linux)
- [CVE-2024-50186](https://cve.now/CVE-2024-50186.md): net: explicitly clear the sk pointer, when pf-\>create fails (CVSS 7.8, Linux)
- [CVE-2024-50185](https://cve.now/CVE-2024-50185.md): mptcp: handle consistently DSS corruption (CVSS 8.2, Linux)
- [CVE-2024-50184](https://cve.now/CVE-2024-50184.md): virtio\_pmem: Check device status before requesting flush (CVSS 5.5, Linux)
- [CVE-2024-50183](https://cve.now/CVE-2024-50183.md): scsi: lpfc: Ensure DA\_ID handling completion before deleting an NPIV instance (CVSS 4.7, Linux)
- [CVE-2024-50182](https://cve.now/CVE-2024-50182.md): secretmem: disable memfd\_secret() if arch cannot set direct map (CVSS 7.1, Linux)
- [CVE-2024-50180](https://cve.now/CVE-2024-50180.md): fbdev: sisfb: Fix strbuf array overflow (CVSS 7.8, Linux)
- [CVE-2024-10621](https://cve.now/CVE-2024-10621.md): Simple Shortcode for Google Maps \<= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, fullworks Simple Shortcode for Google Maps)
- [CVE-2024-10993](https://cve.now/CVE-2024-10993.md): Codezips Online Institute Management System manage\_website.php unrestricted upload (CVSS 5.3, Codezips Online Institute Management System)
- [CVE-2024-50179](https://cve.now/CVE-2024-50179.md): ceph: remove the incorrect Fw reference check when dirtying pages (CVSS 5.5, Linux)
- [CVE-2024-50178](https://cve.now/CVE-2024-50178.md): cpufreq: loongson3: Use raw\_smp\_processor\_id() in do\_service\_request() (CVSS 5.5, Linux)
- [CVE-2024-50177](https://cve.now/CVE-2024-50177.md): drm/amd/display: fix a UBSAN warning in DML2.1 (CVSS 5.5, Linux)
- [CVE-2024-50176](https://cve.now/CVE-2024-50176.md): remoteproc: k3-r5: Fix error handling when power-up failed (CVSS 5.5, Linux)
- [CVE-2024-50175](https://cve.now/CVE-2024-50175.md): media: qcom: camss: Remove use\_count guard in stop\_streaming (CVSS 7.8, Linux)
- [CVE-2024-50174](https://cve.now/CVE-2024-50174.md): drm/panthor: Fix race when converting group handle to group object (CVSS 7.8, Linux)
- [CVE-2024-50173](https://cve.now/CVE-2024-50173.md): drm/panthor: Fix access to uninitialized variable in tick\_ctx\_cleanup() (CVSS 7.8, Linux)
- [CVE-2024-10991](https://cve.now/CVE-2024-10991.md): Codezips Hospital Appointment System editBranchResult.php sql injection (CVSS 6.9, Codezips Hospital Appointment System)
- [CVE-2024-21538](https://cve.now/CVE-2024-21538.md): Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) (CVSS 8.7, cross-spawn · org.webjars.npm:cross-spawn)
- [CVE-2024-10990](https://cve.now/CVE-2024-10990.md): SourceCodester Online Veterinary Appointment System view\_service.php sql injection (CVSS 5.3, SourceCodester Online Veterinary Appointment System)
- [CVE-2024-10989](https://cve.now/CVE-2024-10989.md): code-projects E-Health Care System detail.php sql injection (CVSS 5.3, code-projects E-Health Care System)
- [CVE-2024-10988](https://cve.now/CVE-2024-10988.md): code-projects E-Health Care System doctor\_login.php sql injection (CVSS 6.9, code-projects E-Health Care System)
- [CVE-2024-10987](https://cve.now/CVE-2024-10987.md): code-projects E-Health Care System user\_appointment.php sql injection (CVSS 5.3, code-projects E-Health Care System)
- [CVE-2024-48010](https://cve.now/CVE-2024-48010.md): Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerability. (CVSS 6.5, Dell PowerProtect DD)
- [CVE-2024-45759](https://cve.now/CVE-2024-45759.md): Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerabil (CVSS 6.8, Dell PowerProtect DD)
- [CVE-2024-48011](https://cve.now/CVE-2024-48011.md): Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. (CVSS 3.1, Dell PowerProtect DD)
- [CVE-2020-8007](https://cve.now/CVE-2020-8007.md): The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via th (CVSS 9.8)
- [CVE-2023-27195](https://cve.now/CVE-2023-27195.md): Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm\_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration (CVSS 9.8)
- [CVE-2024-25431](https://cve.now/CVE-2024-25431.md): An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges (CVSS 8.8)
- [CVE-2024-27527](https://cve.now/CVE-2024-27527.md): wasm3 139076a is vulnerable to Denial of Service (DoS). (CVSS 7.5, pywasm3)
- [CVE-2024-27528](https://cve.now/CVE-2024-27528.md): wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution. (CVSS 8.4, pywasm3)
- [CVE-2024-27529](https://cve.now/CVE-2024-27529.md): wasm3 139076a contains memory leaks in Read\_utf8. (CVSS 8.4, github.com/shareup/wasm-interpreter-apple · pywasm3 +1)
- [CVE-2024-27530](https://cve.now/CVE-2024-27530.md): wasm3 139076a contains a Use-After-Free in ForEachModule. (CVSS 8.4, pywasm3)
- [CVE-2024-27532](https://cve.now/CVE-2024-27532.md): wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function \`block\_type\_get\_res (CVSS 7.5)
- [CVE-2024-35410](https://cve.now/CVE-2024-35410.md): wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c. (CVSS 6.2)
- [CVE-2024-35418](https://cve.now/CVE-2024-35418.md): wac commit 385e1 was discovered to contain a heap overflow via the setup\_call function at /wac-asan/wa.c. (CVSS 6.2)
- [CVE-2024-35419](https://cve.now/CVE-2024-35419.md): wac commit 385e1 was discovered to contain a heap overflow via the load\_module function at /wac-asan/wa.c. (CVSS 5.5)
- [CVE-2024-35420](https://cve.now/CVE-2024-35420.md): wac commit 385e1 was discovered to contain a heap overflow. (CVSS 6.2)
- [CVE-2024-35421](https://cve.now/CVE-2024-35421.md): vmir e8117 was discovered to contain a segmentation violation via the wasm\_parse\_block function at /src/vmir\_wasm\_parser.c. (CVSS 5.5)
- [CVE-2024-35422](https://cve.now/CVE-2024-35422.md): vmir e8117 was discovered to contain a heap buffer overflow via the wasm\_call function at /src/vmir\_wasm\_parser.c. (CVSS 7.8)
- [CVE-2024-35423](https://cve.now/CVE-2024-35423.md): vmir e8117 was discovered to contain a heap buffer overflow via the wasm\_parse\_section\_functions function at /src/vmir\_wasm\_parser.c. (CVSS 7.8)
- [CVE-2024-35424](https://cve.now/CVE-2024-35424.md): vmir e8117 was discovered to contain a segmentation violation via the import\_function function at /src/vmir\_wasm\_parser.c. (CVSS 5.5)
- [CVE-2024-35425](https://cve.now/CVE-2024-35425.md): vmir e8117 was discovered to contain a segmentation violation via the function\_prepare\_parse function at /src/vmir\_function.c. (CVSS 5.5)
- [CVE-2024-35426](https://cve.now/CVE-2024-35426.md): vmir e8117 was discovered to contain a stack overflow via the init\_local\_vars function at /src/vmir\_wasm\_parser.c. (CVSS 9.8)
- [CVE-2024-35427](https://cve.now/CVE-2024-35427.md): vmir e8117 was discovered to contain a segmentation violation via the export\_function function at /src/vmir\_wasm\_parser.c. (CVSS 5.5)
- [CVE-2024-40239](https://cve.now/CVE-2024-40239.md): An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate pri (CVSS 6.1)
- [CVE-2024-40240](https://cve.now/CVE-2024-40240.md): An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privilege (CVSS 6.1)
- [CVE-2024-44765](https://cve.now/CVE-2024-44765.md): An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privil (CVSS 6.5)
- [CVE-2024-46947](https://cve.now/CVE-2024-46947.md): Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF. (CVSS 6.5)
- [CVE-2024-46948](https://cve.now/CVE-2024-46948.md): Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control. (CVSS 5.3)
- [CVE-2024-47190](https://cve.now/CVE-2024-47190.md): Northern.tech Hosted Mender before 2024.07.11 allows SSRF. (CVSS 2.7)
- [CVE-2024-48073](https://cve.now/CVE-2024-48073.md): sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. (CVSS 9.8)
- [CVE-2024-50634](https://cve.now/CVE-2024-50634.md): A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token (CVSS 8.8)
- [CVE-2024-50808](https://cve.now/CVE-2024-50808.md): SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, (CVSS 8.8)
- [CVE-2024-50809](https://cve.now/CVE-2024-50809.md): The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands (CVSS 8.8)
- [CVE-2024-50810](https://cve.now/CVE-2024-50810.md): hopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function. (CVSS 5.4)
- [CVE-2024-50811](https://cve.now/CVE-2024-50811.md): hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\\\apps\\\\tool\\\\apis\\\\bd (CVSS 9.1)
- [CVE-2024-50966](https://cve.now/CVE-2024-50966.md): dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin. (CVSS 9.3)
- [CVE-2024-51030](https://cve.now/CVE-2024-51030.md): A SQL injection vulnerability in manage\_client.php and view\_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to e (CVSS 6.5)
- [CVE-2024-51031](https://cve.now/CVE-2024-51031.md): A Cross-site Scripting (XSS) vulnerability in manage\_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated use (CVSS 5.4)
- [CVE-2024-51032](https://cve.now/CVE-2024-51032.md): A Cross-site Scripting (XSS) vulnerability in manage\_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authentica (CVSS 5.4)
- [CVE-2024-51055](https://cve.now/CVE-2024-51055.md): An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component. (CVSS 6.5)
- [CVE-2024-51152](https://cve.now/CVE-2024-51152.md): File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component (CVSS 7.2)
- [CVE-2024-51157](https://cve.now/CVE-2024-51157.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://erp.07fly.net:80/oa/OaSchedule/add.ht (CVSS 4.7)
- [CVE-2024-51211](https://cve.now/CVE-2024-51211.md): SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.