# CVEs published 2024-11-10

35 CVEs were published on November 10, 2024: 1 critical, 11 high. Days are UTC.

- [CVE-2024-11059](https://cve.now/CVE-2024-11059.md): Project Worlds Free Download Online Shopping System success.php sql injection (CVSS 5.3, Project Worlds Free Download Online Shopping System)
- [CVE-2024-11058](https://cve.now/CVE-2024-11058.md): CodeAstro Real Estate Management System About Us Page aboutedit.php sql injection (CVSS 5.1, CodeAstro Real Estate Management System)
- [CVE-2024-11057](https://cve.now/CVE-2024-11057.md): Codezips Hospital Appointment System removeBranchResult.php sql injection (CVSS 6.9, Codezips Hospital Appointment System)
- [CVE-2024-11056](https://cve.now/CVE-2024-11056.md): Tenda AC10 WifiExtraSet FUN\_0046AC38 stack-based overflow (CVSS 8.7, Tenda AC10)
- [CVE-2024-11055](https://cve.now/CVE-2024-11055.md): 1000 Projects Beauty Parlour Management System admin-profile.php sql injection (CVSS 6.9, 1000 Projects Beauty Parlour Management System)
- [CVE-2024-10958](https://cve.now/CVE-2024-10958.md): WP Photo Album Plus \<= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay (CVSS 7.3, opajaap WP Photo Album Plus)
- [CVE-2024-10265](https://cve.now/CVE-2024-10265.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.30 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2024-51576](https://cve.now/CVE-2024-51576.md): WordPress AMP Img Shortcode plugin \<= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpza AMP Img Shortcode)
- [CVE-2024-11054](https://cve.now/CVE-2024-11054.md): SourceCodester Simple Music Cloud Community System ajax.php unrestricted upload (CVSS 5.3, SourceCodester Simple Music Cloud Community System)
- [CVE-2024-51577](https://cve.now/CVE-2024-51577.md): WordPress bpmn.io plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, neville.lugton bpmn.io)
- [CVE-2024-51578](https://cve.now/CVE-2024-51578.md): WordPress 3D Presentation plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, lpagg 3D Presentation)
- [CVE-2024-51580](https://cve.now/CVE-2024-51580.md): WordPress Clever Addons for Elementor plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zootemplate Clever Addons for Elementor)
- [CVE-2024-51581](https://cve.now/CVE-2024-51581.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Restaurant & Cafe Addon for Elementor)
- [CVE-2024-51583](https://cve.now/CVE-2024-51583.md): WordPress Kento Ads Rotator plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PluginsPoint Kento Ads Rotator)
- [CVE-2024-51584](https://cve.now/CVE-2024-51584.md): WordPress Marquee Elementor with Posts plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, anas2004 Marquee Elementor with Posts)
- [CVE-2024-11051](https://cve.now/CVE-2024-11051.md): AMTT Hotel Broadband Operation System online\_status.php sql injection (CVSS 5.3, AMTT Hotel Broadband Operation System)
- [CVE-2024-11050](https://cve.now/CVE-2024-11050.md): AMTT Hotel Broadband Operation System language.php cross site scripting (CVSS 5.3, AMTT Hotel Broadband Operation System)
- [CVE-2024-11049](https://cve.now/CVE-2024-11049.md): ZKTeco ZKBio Time Image File photo direct request (CVSS 6.3, ZKTeco ZKBio Time)
- [CVE-2024-11048](https://cve.now/CVE-2024-11048.md): D-Link DI-8003 dbsrv.asp dbsrv\_asp stack-based overflow (CVSS 8.7, D-Link DI-8003)
- [CVE-2024-11047](https://cve.now/CVE-2024-11047.md): D-Link DI-8003 upgrade\_filter.asp upgrade\_filter\_asp stack-based overflow (CVSS 8.7, D-Link DI-8003)
- [CVE-2024-11046](https://cve.now/CVE-2024-11046.md): D-Link DI-8003 upgrade\_filter.asp upgrade\_filter\_asp os command injection (CVSS 5.3, D-Link DI-8003)
- [CVE-2020-10367](https://cve.now/CVE-2020-10367.md): Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" (CVSS 5.5)
- [CVE-2020-10368](https://cve.now/CVE-2020-10368.md): Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spe (CVSS 3.5)
- [CVE-2020-10369](https://cve.now/CVE-2020-10369.md): Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory conte (CVSS 5.5)
- [CVE-2020-10370](https://cve.now/CVE-2020-10370.md): Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bl (CVSS 8.8)
- [CVE-2021-35473](https://cve.now/CVE-2021-35473.md): An issue was discovered in LemonLDAP::NG before 2.0.12. (CVSS 9.1)
- [CVE-2021-41737](https://cve.now/CVE-2021-41737.md): In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(333333333333333 (CVSS 7.5)
- [CVE-2023-40457](https://cve.now/CVE-2023-40457.md): The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a (no CVSS)
- [CVE-2024-46613](https://cve.now/CVE-2024-46613.md): WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items (CVSS 4.3)
- [CVE-2024-46951](https://cve.now/CVE-2024-46951.md): An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. (CVSS 7.8)
- [CVE-2024-46952](https://cve.now/CVE-2024-46952.md): An issue was discovered in pdf/pdf\_xref.c in Artifex Ghostscript before 10.04.0. (CVSS 8.4)
- [CVE-2024-46953](https://cve.now/CVE-2024-46953.md): An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. (CVSS 7.8)
- [CVE-2024-46954](https://cve.now/CVE-2024-46954.md): An issue was discovered in decode\_utf8 in base/gp\_utf8.c in Artifex Ghostscript before 10.04.0. (CVSS 8.4)
- [CVE-2024-46955](https://cve.now/CVE-2024-46955.md): An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. (CVSS 5.5)
- [CVE-2024-46956](https://cve.now/CVE-2024-46956.md): An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.