# CVEs published 2024-12-23

28 CVEs were published on December 23, 2024: 3 critical, 10 high. Days are UTC.

- [CVE-2018-25106](https://cve.now/CVE-2018-25106.md): webuidesigning NebulaX Theme Legacy.php nebula\_send\_to\_hubspot sql injection (CVSS 5.3, webuidesigning NebulaX Theme)
- [CVE-2024-53961](https://cve.now/CVE-2024-53961.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.1, Adobe ColdFusion)
- [CVE-2024-56363](https://cve.now/CVE-2024-56363.md): APTRS has SSTI vulnerability (CVSS 7.8, APTRS)
- [CVE-2024-56362](https://cve.now/CVE-2024-56362.md): Navidrome Stores JWT Secret in Plaintext in navidrome.db (CVSS 7.1, navidrome · github.com/navidrome/navidrome)
- [CVE-2024-53276](https://cve.now/CVE-2024-53276.md): GHSL-2024-092: Open CORS policy in home-gallery (CVSS 6.3, xemle home-gallery)
- [CVE-2024-53275](https://cve.now/CVE-2024-53275.md): GHSL-2024-091: DNS rebinding attack in home-gallery (CVSS 5.3, xemle home-gallery)
- [CVE-2024-56364](https://cve.now/CVE-2024-56364.md): Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx (CVSS 5.4, shuchkin simplexlsx · shuchkin/simplexlsx)
- [CVE-2024-56326](https://cve.now/CVE-2024-56326.md): Jinja has a sandbox breakout through indirect reference to format method (CVSS 5.4, pallets jinja · jinja2)
- [CVE-2024-56201](https://cve.now/CVE-2024-56201.md): Jinja has a sandbox breakout through malicious filenames (CVSS 5.4, pallets jinja · jinja2)
- [CVE-2024-45387](https://cve.now/CVE-2024-45387.md): Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice\_request\_comments (CVSS 9.9, Apache Software Foundation Apache Traffic Control · gith… +1)
- [CVE-2024-23945](https://cve.now/CVE-2024-23945.md): Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails (CVSS 5.9, Apache Software Foundation Apache Hive · Apache Software… +3)
- [CVE-2024-55947](https://cve.now/CVE-2024-55947.md): Gogs has a Path Traversal in file update API (CVSS 8.7, gogs · gogs.io/gogs)
- [CVE-2024-54148](https://cve.now/CVE-2024-54148.md): Gogs has a Path Traversal in file editing UI (CVSS 8.7, gogs · gogs.io/gogs)
- [CVE-2024-53256](https://cve.now/CVE-2024-53256.md): Rizin has a command injection via RzBinInfo bclass due legacy code (CVSS 7.8, rizinorg rizin)
- [CVE-2024-55539](https://cve.now/CVE-2024-55539.md): Weak algorithm used to sign RPM package. (CVSS 2.5, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2024-12903](https://cve.now/CVE-2024-12903.md): Incorrect default permissions in Biamp Evoko Home (CVSS 7.8, Biamp Evoko Home Service)
- [CVE-2024-12902](https://cve.now/CVE-2024-12902.md): Global Wisdom Software ANCHOR - Undocumented Privileged Account (CVSS 8.4, Global Wisdom Software ANCHOR)
- [CVE-2024-11230](https://cve.now/CVE-2024-11230.md): Elementor Header & Footer Builder \<= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget (CVSS 6.4, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-12901](https://cve.now/CVE-2024-12901.md): FoxCMS API Endpoint Site.php improper authorization (CVSS 6.9, FoxCMS)
- [CVE-2024-12900](https://cve.now/CVE-2024-12900.md): FoxCMS Configuration File installdb.php code injection (CVSS 5.3, FoxCMS)
- [CVE-2024-12899](https://cve.now/CVE-2024-12899.md): 1000 Projects Attendance Tracking Management System course\_action.php sql injection (CVSS 6.9, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-54082](https://cve.now/CVE-2024-54082.md): home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. (CVSS 7.2, Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-54C)
- [CVE-2024-52321](https://cve.now/CVE-2024-52321.md): Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. (CVSS 5.9, Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +4)
- [CVE-2024-47864](https://cve.now/CVE-2024-47864.md): home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. (CVSS 5.3, Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +1)
- [CVE-2024-46873](https://cve.now/CVE-2024-46873.md): Multiple SHARP routers leave the hidden debug function enabled. (CVSS 9.8, Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +4)
- [CVE-2024-45721](https://cve.now/CVE-2024-45721.md): home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration sc (CVSS 7.2, Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +1)
- [CVE-2024-12898](https://cve.now/CVE-2024-12898.md): 1000 Projects Attendance Tracking Management System faculty\_action.php sql injection (CVSS 5.3, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-40896](https://cve.now/CVE-2024-40896.md): In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if c (CVSS 9.1, libxml2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.