# CVEs published 2024-12-12

149 CVEs were published on December 12, 2024: 13 critical, 24 high. Days are UTC.

- [CVE-2024-12289](https://cve.now/CVE-2024-12289.md): Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service (CVSS 5.9, HashiCorp Boundary · github.com/hashicorp/boundary)
- [CVE-2024-55888](https://cve.now/CVE-2024-55888.md): Content Security Policy appears to be missing in software and production setup (CVSS 7.1, scidsg hushline)
- [CVE-2024-55886](https://cve.now/CVE-2024-55886.md): OpenTelemetry Logs source may lack authentication with some custom plugins (CVSS 6.9, opensearch-project data-prepper)
- [CVE-2024-55885](https://cve.now/CVE-2024-55885.md): Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames (CVSS 6.9, beego · github.com/beego/beego +1)
- [CVE-2024-55878](https://cve.now/CVE-2024-55878.md): Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx (CVSS 6.8, shuchkin simplexlsx · shuchkin/simplexlsx)
- [CVE-2024-55879](https://cve.now/CVE-2024-55879.md): XWiki allows RCE from script right in configurable sections (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-administ…)
- [CVE-2024-55877](https://cve.now/CVE-2024-55877.md): XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-help-ui)
- [CVE-2024-49071](https://cve.now/CVE-2024-49071.md): Windows Defender Information Disclosure Vulnerability (CVSS 6.5, Microsoft Defender for Endpoint for Windows)
- [CVE-2024-49147](https://cve.now/CVE-2024-49147.md): Microsoft Update Catalog Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Update Catalog)
- [CVE-2024-55876](https://cve.now/CVE-2024-55876.md): XWiki's scheduler in subwiki allows scheduling operations for any main wiki user (CVSS 5.4, xwiki-platform · org.xwiki.platform:xwiki-platform-schedule…)
- [CVE-2024-55875](https://cve.now/CVE-2024-55875.md): http4k has a potential XXE (XML External Entity Injection) vulnerability (CVSS 9.8, http4k · org.http4k:http4k-format-xml)
- [CVE-2024-55663](https://cve.now/CVE-2024-55663.md): XWiki Platform has an SQL injection in getdocuments.vm with sort parameter (CVSS 8.6, xwiki-platform · org.xwiki.platform:xwiki-platform-distribu…)
- [CVE-2024-47238](https://cve.now/CVE-2024-47238.md): Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. (CVSS 7.5, Dell Client Platform BIOS)
- [CVE-2024-55662](https://cve.now/CVE-2024-55662.md): XWiki allows remote code execution through the extension sheet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-reposito…)
- [CVE-2024-52901](https://cve.now/CVE-2024-52901.md): IBM InfoSphere Information Server denial of service (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2024-55633](https://cve.now/CVE-2024-55633.md): Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access (CVSS 7.1, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-21575](https://cve.now/CVE-2024-21575.md): ComfyUI-Impact-Pack is vulnerable to Path Traversal. (CVSS 9.2, ltdrdata ComfyUI-Impact-Pack)
- [CVE-2024-28143](https://cve.now/CVE-2024-28143.md): Insecure Password Change Function (CVSS 8.4, Image Access Scan2Net)
- [CVE-2024-28146](https://cve.now/CVE-2024-28146.md): Hardcoded credentials (CVSS 8.4, Image Access Scan2Net)
- [CVE-2024-50584](https://cve.now/CVE-2024-50584.md): SQL Injection (CVSS 4.4, Image Access Scan2Net)
- [CVE-2024-28145](https://cve.now/CVE-2024-28145.md): Unauthenticated SQL Injection (CVSS 5.9, Image Access Scan2Net)
- [CVE-2024-28144](https://cve.now/CVE-2024-28144.md): Broken Access Control (CVSS 5.5, Image Access Scan2Net)
- [CVE-2024-36494](https://cve.now/CVE-2024-36494.md): Reflected Cross Site Scripting (CVSS 4.7, Image Access Scan2Net)
- [CVE-2024-36498](https://cve.now/CVE-2024-36498.md): Stored cross site scripting (CVSS 4.7, Image Access Scan2Net)
- [CVE-2024-12271](https://cve.now/CVE-2024-12271.md): 360 Javascript Viewer \<= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, jtermaat 360 Javascript Viewer)
- [CVE-2024-47947](https://cve.now/CVE-2024-47947.md): Stored cross site scripting (CVSS 4.7, Image Access Scan2Net)
- [CVE-2024-28142](https://cve.now/CVE-2024-28142.md): Stored cross site scripting (CVSS 4.7, Image Access Scan2Net)
- [CVE-2024-54122](https://cve.now/CVE-2024-54122.md): Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availability (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-54119](https://cve.now/CVE-2024-54119.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-54117](https://cve.now/CVE-2024-54117.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-54116](https://cve.now/CVE-2024-54116.md): Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abno (CVSS 4.3, Huawei HarmonyOS)
- [CVE-2024-54115](https://cve.now/CVE-2024-54115.md): Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 4.3, Huawei HarmonyOS)
- [CVE-2024-54114](https://cve.now/CVE-2024-54114.md): Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availabi (CVSS 4.4, Huawei HarmonyOS)
- [CVE-2024-54113](https://cve.now/CVE-2024-54113.md): Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect p (CVSS 6.5, Huawei HarmonyOS)
- [CVE-2024-54112](https://cve.now/CVE-2024-54112.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-54111](https://cve.now/CVE-2024-54111.md): Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 5.7, Huawei HarmonyOS)
- [CVE-2024-54110](https://cve.now/CVE-2024-54110.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-54109](https://cve.now/CVE-2024-54109.md): Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 6.5, Huawei HarmonyOS)
- [CVE-2024-54108](https://cve.now/CVE-2024-54108.md): Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 6.5, Huawei HarmonyOS)
- [CVE-2024-8179](https://cve.now/CVE-2024-8179.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab)
- [CVE-2024-8233](https://cve.now/CVE-2024-8233.md): Inefficient Algorithmic Complexity in GitLab (CVSS 7.5, GitLab)
- [CVE-2024-8647](https://cve.now/CVE-2024-8647.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 5.4, GitLab)
- [CVE-2024-9367](https://cve.now/CVE-2024-9367.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-9387](https://cve.now/CVE-2024-9387.md): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (CVSS 6.4, GitLab)
- [CVE-2024-10043](https://cve.now/CVE-2024-10043.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2024-11274](https://cve.now/CVE-2024-11274.md): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (CVSS 8.7, GitLab)
- [CVE-2024-54107](https://cve.now/CVE-2024-54107.md): Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 7.1, Huawei HarmonyOS)
- [CVE-2024-54106](https://cve.now/CVE-2024-54106.md): Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availa (CVSS 7.1, Huawei HarmonyOS)
- [CVE-2024-54105](https://cve.now/CVE-2024-54105.md): Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2024-54104](https://cve.now/CVE-2024-54104.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-54103](https://cve.now/CVE-2024-54103.md): Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confid (CVSS 6.1, Huawei HarmonyOS)
- [CVE-2024-54102](https://cve.now/CVE-2024-54102.md): Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality. (CVSS 6.1, Huawei HarmonyOS)
- [CVE-2024-54101](https://cve.now/CVE-2024-54101.md): Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availabil (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-12570](https://cve.now/CVE-2024-12570.md): Privilege Context Switching Error in GitLab (CVSS 6.7, GitLab)
- [CVE-2024-12292](https://cve.now/CVE-2024-12292.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 4.0, GitLab)
- [CVE-2024-54100](https://cve.now/CVE-2024-54100.md): Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-54099](https://cve.now/CVE-2024-54099.md): File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiali (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-54098](https://cve.now/CVE-2024-54098.md): Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service inte (CVSS 8.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-54097](https://cve.now/CVE-2024-54097.md): Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and inte (CVSS 7.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-54096](https://cve.now/CVE-2024-54096.md): Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and ac (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-12401](https://cve.now/CVE-2024-12401.md): Cert-manager: potential dos when parsing specially crafted pem inputs (CVSS 4.4, cert-manager · Red Hat Cryostat +7)
- [CVE-2024-12397](https://cve.now/CVE-2024-12397.md): Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling (CVSS 7.4, quarkus-http · Red Hat Cryostat 4 on RHEL +13)
- [CVE-2024-12160](https://cve.now/CVE-2024-12160.md): Seraphinite Bulk Discounts for WooCommerce \<= 2.4.6 - Reflected Cross-Site Scripting (CVSS 6.1, seraphinitesoft Seraphinite Bulk Discounts for WooCommerce)
- [CVE-2024-11760](https://cve.now/CVE-2024-11760.md): Currency Converter Widget ⚡ PRO \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, falselight Currency Converter Widget ⚡ PRO)
- [CVE-2024-12333](https://cve.now/CVE-2024-12333.md): WoodMart \<= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, xTemos Woodmart)
- [CVE-2024-21574](https://cve.now/CVE-2024-21574.md): The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom (CVSS 10.0, ltdrdata ComfyUI-Manager)
- [CVE-2024-12564](https://cve.now/CVE-2024-12564.md): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3 (CVSS 6.9, Open Design Alliance CDE inWEB SDK)
- [CVE-2024-12329](https://cve.now/CVE-2024-12329.md): Essential Real Estate \<= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure (CVSS 4.3, g5theme Essential Real Estate)
- [CVE-2024-11724](https://cve.now/CVE-2024-11724.md): Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) \<= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script (CVSS 4.3, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2024-12201](https://cve.now/CVE-2024-12201.md): Hash Form \<= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation (CVSS 4.3, hashthemes Hash Form – Drag & Drop Form Builder)
- [CVE-2024-12312](https://cve.now/CVE-2024-12312.md): Print Science Designer \<= 1.3.152 - Unauthenticated PHP Object Injection (CVSS 8.1, johnwwweissberg Print Science Designer)
- [CVE-2024-10583](https://cve.now/CVE-2024-10583.md): Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder \<= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, danieliser Popup Maker – Boost Sales, Conversions, Optins,…)
- [CVE-2024-11727](https://cve.now/CVE-2024-11727.md): NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar \<= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2024-11181](https://cve.now/CVE-2024-11181.md): Greenshift – animation and page builder blocks \<= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2024-10784](https://cve.now/CVE-2024-10784.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2024-9881](https://cve.now/CVE-2024-9881.md): LearnPress \< 4.2.7.2 - Admin+ Stored XSS (CVSS 4.8, LearnPress)
- [CVE-2024-9641](https://cve.now/CVE-2024-9641.md): LuckyWP Table of Contents \< 2.1.7 - Admin+ Stored XSS (CVSS 4.8, LuckyWP Table of Contents)
- [CVE-2024-9428](https://cve.now/CVE-2024-9428.md): Popup Builder \< 4.3.5 - Admin+ Stored XSS (CVSS 4.8, Popup Builder)
- [CVE-2024-10637](https://cve.now/CVE-2024-10637.md): Kadence Blocks \< 3.2.54 - Admin+ Stored XSS (CVSS 5.4, Gutenberg Blocks with AI by Kadence WP)
- [CVE-2024-10568](https://cve.now/CVE-2024-10568.md): Ajax Search Lite \< 4.12.4 - Admin+ Stored XSS (CVSS 4.7, Ajax Search Lite)
- [CVE-2024-10518](https://cve.now/CVE-2024-10518.md): ProfilePress \< 4.15.15 - Admin+ Stored XSS (CVSS 4.8, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2024-10517](https://cve.now/CVE-2024-10517.md): ProfilePress \< 4.15.15 - Admin+ Stored XSS (CVSS 4.8, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2024-10499](https://cve.now/CVE-2024-10499.md): AI-Engine \< 2.6.5 - Admin+ SQLi (CVSS 7.2, AI Engine)
- [CVE-2024-10010](https://cve.now/CVE-2024-10010.md): LearnPress \< 4.2.7.2 - Admin+ Stored XSS (CVSS 4.8, LearnPress)
- [CVE-2024-12263](https://cve.now/CVE-2024-12263.md): Child Theme Creator by Orbisius \<= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete (CVSS 4.3, lordspace Child Theme Creator by Orbisius)
- [CVE-2024-12059](https://cve.now/CVE-2024-12059.md): ElementInvader Addons for Elementor \<= 1.3.1 - Missing Authorization to Arbitrary Options Read (CVSS 4.3, ElementInvader Addons for Elementor)
- [CVE-2024-12265](https://cve.now/CVE-2024-12265.md): Web3 Cryptocurrency Payments by DePay for WooCommerce \<= 2.12.17 - Missing Authorization to Information Exposure (CVSS 5.3, depayfi Web3 Crypto Payments by DePay for WooCommerce)
- [CVE-2024-11052](https://cve.now/CVE-2024-11052.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations (CVSS 7.2, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-11766](https://cve.now/CVE-2024-11766.md): WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, samdani GS Books Showcase – Display Books in Grid, Slider &…)
- [CVE-2024-11785](https://cve.now/CVE-2024-11785.md): Integrate Firebase \<= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hanthuy Integrate Firebase)
- [CVE-2024-11871](https://cve.now/CVE-2024-11871.md): Social Media Shortcodes \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tw2113 Social Media Shortcodes)
- [CVE-2024-11757](https://cve.now/CVE-2024-11757.md): WP GeoNames \<= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sojahu WP GeoNames)
- [CVE-2024-12255](https://cve.now/CVE-2024-12255.md): Accept Stripe Payments Using Contact Form 7 \<= 2.5 - Unauthenticated Information Exposure (CVSS 5.3, zealopensource Accept Stripe Payments Using Contact Form)
- [CVE-2024-10124](https://cve.now/CVE-2024-10124.md): Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce \<= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation (CVSS 9.8, themehunk Vayu Blocks – Website Builder for the Block Editor)
- [CVE-2024-12172](https://cve.now/CVE-2024-12172.md): WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses \<= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update (CVSS 7.5, hookandhook WP Courses LMS – Online Courses Builder, eLearn…)
- [CVE-2024-11765](https://cve.now/CVE-2024-11765.md): WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more \<= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, samdani GS Portfolio – A Plugin for Making Filterable Portf…)
- [CVE-2024-12072](https://cve.now/CVE-2024-12072.md): Analytics Cat – Google Analytics Made Easy \<= 1.1.2 - Reflected Cross-Site Scripting (CVSS 6.1, fatcatapps Analytics Cat – Google Analytics Made Easy)
- [CVE-2024-12018](https://cve.now/CVE-2024-12018.md): Snippet Shortcodes \<= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion (CVSS 4.3, aliakro Snippet Shortcodes)
- [CVE-2024-11359](https://cve.now/CVE-2024-11359.md): Library Bookshelves \<= 5.8 - Reflected Cross-Site Scripting (CVSS 6.1, photonicgnostic Library Bookshelves)
- [CVE-2024-12040](https://cve.now/CVE-2024-12040.md): Product Carousel Slider & Grid Ultimate for WooCommerce \<= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme' (CVSS 8.8, wpwax Product Carousel Slider & Grid Ultimate for WooCommer…)
- [CVE-2024-11781](https://cve.now/CVE-2024-11781.md): Smart Agenda – Prise de rendez-vous en ligne \<= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, SmartAgenda – Prise de rendez-vous en ligne)
- [CVE-2024-11882](https://cve.now/CVE-2024-11882.md): FAQ And Answers – Create Frequently Asked Questions Area on WP Sites \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bplugins Awesome FAQ – Modern Accordion, Tabs,Responsive &…)
- [CVE-2024-12526](https://cve.now/CVE-2024-12526.md): Arena.IM – Live Blogging for real-time events \<= 0.4.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, arenaim Arena.IM – Live Blogging for real-time events)
- [CVE-2024-11709](https://cve.now/CVE-2024-11709.md): AI Post Generator | AutoWriter \<= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion (CVSS 4.3, kekotron AI Post Generator | AutoWriter)
- [CVE-2024-12441](https://cve.now/CVE-2024-12441.md): BP Email Assign Templates \<= 1.5 - Reflected Cross-Site Scripting (CVSS 6.1, shanebp BP Email Assign Templates)
- [CVE-2024-12156](https://cve.now/CVE-2024-12156.md): AI Content Writer, RSS Feed to Post, Autoblogging SEO Help \<= 6.1.3 - Reflected Cross-Site Scripting (CVSS 6.1, quantumcloud QC SEO Help for llms.txt, AI Analytics, AI Con…)
- [CVE-2024-12162](https://cve.now/CVE-2024-12162.md): Video & Photo Gallery for Ultimate Member \<= 1.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, suiteplugins Video & Photo Gallery for Ultimate Member)
- [CVE-2024-11459](https://cve.now/CVE-2024-11459.md): Country Blocker \<= 3.2 - Reflected Cross-Site Scripting (CVSS 6.1, karlkiesinger Country Blocker)
- [CVE-2024-11804](https://cve.now/CVE-2024-11804.md): Planaday API \<= 11.4 - Reflected Cross-Site Scripting (CVSS 6.1, Planaday API)
- [CVE-2024-10182](https://cve.now/CVE-2024-10182.md): Cognito Forms \<= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, cognitoapps Cognito Forms)
- [CVE-2024-12463](https://cve.now/CVE-2024-12463.md): Arena.IM – Live Blogging for real-time events \<= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena\_embed\_amp Shortcode (CVSS 6.4, arenaim Arena.IM – Live Blogging for real-time events)
- [CVE-2024-11384](https://cve.now/CVE-2024-11384.md): Arena.IM – Live Blogging for real-time events \<= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, arenaim Arena.IM – Live Blogging for real-time events)
- [CVE-2024-11410](https://cve.now/CVE-2024-11410.md): Top and footer bars for announcements, notifications, advertisements, promotions – YooBar \<= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sharabindu Yoo Bar – Floating Notification & Promo Bar for…)
- [CVE-2024-10590](https://cve.now/CVE-2024-10590.md): Opt-In Downloads \<= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, halfdata Opt-In Downloads)
- [CVE-2024-11875](https://cve.now/CVE-2024-11875.md): Add infos to the events calendar \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hage Add infos to The Events Calendar)
- [CVE-2024-10910](https://cve.now/CVE-2024-10910.md): Grid Plus – Unlimited grid layout \<= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid\_plus\_load\_by\_category (CVSS 7.3, g5theme Grid Plus – Unlimited grid layout)
- [CVE-2024-11750](https://cve.now/CVE-2024-11750.md): ONLYOFFICE DocSpace \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ONLYOFFICE DocSpace)
- [CVE-2024-11891](https://cve.now/CVE-2024-11891.md): Perfect Font Awesome Integration \<= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kaushik07 Perfect Font Awesome Integration)
- [CVE-2024-12406](https://cve.now/CVE-2024-12406.md): Library Management System \<= 3.2.0 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, owthub Library Management System)
- [CVE-2024-11723](https://cve.now/CVE-2024-11723.md): kvCORE IDX \<= 2.3.35 - Reflected Cross-Site Scripting (CVSS 6.1, insiderealestate kvCORE IDX)
- [CVE-2024-11683](https://cve.now/CVE-2024-11683.md): Newsletter Subscriptions \<= 2.1 - Reflected Cross-Site Scripting (CVSS 6.1, hanif-khan Newsletter Subscriptions)
- [CVE-2024-12258](https://cve.now/CVE-2024-12258.md): WP Service Payment Form With Authorize.net \<= 2.6.3 - Reflected Cross-Site Scripting (CVSS 6.1, shivtiwari WP Service Payment Form With Authorize.net)
- [CVE-2024-12260](https://cve.now/CVE-2024-12260.md): Ultimate Endpoints With Rest Api \<= 2.2.2 - Reflected Cross-Site Scripting (CVSS 6.1, dipankarpal212 Ultimate Endpoints With Rest Api)
- [CVE-2024-12338](https://cve.now/CVE-2024-12338.md): Website Toolbox Community \<= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox\_username (CVSS 6.1, websitetoolbox Website Toolbox Forum)
- [CVE-2024-10111](https://cve.now/CVE-2024-10111.md): OAuth Single Sign On – SSO (OAuth Client) \<= 6.26.3 - Authentication Bypass (CVSS 8.1, cyberlord92 OAuth Single Sign On – SSO)
- [CVE-2024-11901](https://cve.now/CVE-2024-11901.md): PowerBI Embed Reports \<= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cyberlord92 PowerBI Embed Reports)
- [CVE-2024-11417](https://cve.now/CVE-2024-11417.md): dejure.org Vernetzungsfunktion \<= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, dejureorg dejure.org Vernetzungsfunktion)
- [CVE-2024-11015](https://cve.now/CVE-2024-11015.md): Sign In With Google \<= 1.8.0 - Authentication Bypass in authenticate\_user (CVSS 9.8, tarecord Sign In With Google)
- [CVE-2024-11443](https://cve.now/CVE-2024-11443.md): de:branding \<= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, decollete de:branding)
- [CVE-2024-11419](https://cve.now/CVE-2024-11419.md): Password for WP \<= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, get3code Password for WP)
- [CVE-2024-12461](https://cve.now/CVE-2024-12461.md): WP-Revive Adserver \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, zoan WP-Revive Adserver)
- [CVE-2024-11433](https://cve.now/CVE-2024-11433.md): Surbma | SalesAutopilot Shortcode \<= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Surbma | SalesAutopilot Shortcode)
- [CVE-2024-11914](https://cve.now/CVE-2024-11914.md): Gutenberg Blocks and Page Layouts – Attire Blocks \<= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, shafayat-alam Gutenberg Blocks and Page Layouts – Attire Bl…)
- [CVE-2024-11427](https://cve.now/CVE-2024-11427.md): Catch Popup \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, maheshmaharjan Catch Popup)
- [CVE-2024-11279](https://cve.now/CVE-2024-11279.md): Schema App Structured Data \<= 2.2.4 - Reflected Cross-Site Scripting (CVSS 6.1, vberkel Schema App Structured Data)
- [CVE-2024-11689](https://cve.now/CVE-2024-11689.md): HQ Rental Software \<= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 8.8, caagsoftware HQ Rental Software)
- [CVE-2024-11413](https://cve.now/CVE-2024-11413.md): HostFact bestelformulier integratie \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, HostFact bestelformulier integratie)
- [CVE-2024-11430](https://cve.now/CVE-2024-11430.md): SQL Chart Builder \<= 2.3.6 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, elvinhaci SQL Chart Builder)
- [CVE-2024-12341](https://cve.now/CVE-2024-12341.md): Custom Skins Contact Form 7 \<= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation (CVSS 4.3, mahendrapatidarmp Custom Skins Contact Form)
- [CVE-2024-11442](https://cve.now/CVE-2024-11442.md): Horizontal scroll image slideshow \<= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gopiplus Horizontal scroll image slideshow)
- [CVE-2024-42407](https://cve.now/CVE-2024-42407.md): Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenti (CVSS 8.5, Gallagher Command Centre Server)
- [CVE-2024-41146](https://cve.now/CVE-2024-41146.md): Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker w (CVSS 4.6, Gallagher Controller 6000 and Controller)
- [CVE-2024-12536](https://cve.now/CVE-2024-12536.md): SourceCodester Kortex Lite Advocate Office Management System client\_data.php cross site scripting (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-12503](https://cve.now/CVE-2024-12503.md): ClassCMS Model Management Page admin cross site scripting (CVSS 5.1, ClassCMS)
- [CVE-2024-31670](https://cve.now/CVE-2024-31670.md): rizin before v0.6.3 is vulnerable to Buffer Overflow via create\_cache\_bins, read\_cache\_accel, and rz\_dyldcache\_new\_buf functions in librz/bi (CVSS 6.3)
- [CVE-2024-54810](https://cve.now/CVE-2024-54810.md): A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, w (CVSS 9.8)
- [CVE-2024-54811](https://cve.now/CVE-2024-54811.md): A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL (CVSS 9.8)
- [CVE-2024-54842](https://cve.now/CVE-2024-54842.md): A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno param (CVSS 9.8)
- [CVE-2024-55099](https://cve.now/CVE-2024-55099.md): A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.