# CVEs published 2024-12-25

28 CVEs were published on December 25, 2024: 4 critical, 6 high. Days are UTC.

- [CVE-2024-12928](https://cve.now/CVE-2024-12928.md): code-projects Simple Admin Panel sql injection (CVSS 5.3, code-projects Simple Admin Panel)
- [CVE-2024-12927](https://cve.now/CVE-2024-12927.md): 1000 Projects Attendance Tracking Management System check\_faculty\_login.php sql injection (CVSS 6.9, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-12926](https://cve.now/CVE-2024-12926.md): Codezips Project Management System advanced.php sql injection (CVSS 5.3, Codezips Project Management System)
- [CVE-2024-52534](https://cve.now/CVE-2024-52534.md): Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. (CVSS 5.4, Dell ECS)
- [CVE-2024-52543](https://cve.now/CVE-2024-52543.md): Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. (CVSS 6.5, Dell NativeEdge)
- [CVE-2024-53291](https://cve.now/CVE-2024-53291.md): Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. (CVSS 7.5, Dell NativeEdge)
- [CVE-2024-47978](https://cve.now/CVE-2024-47978.md): Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Execution with Unnecessary Privileges vulnerability. (CVSS 7.8, Dell NativeEdge)
- [CVE-2024-52906](https://cve.now/CVE-2024-52906.md): IBM AIX denial of service (CVSS 5.5, IBM AIX)
- [CVE-2024-47102](https://cve.now/CVE-2024-47102.md): IBM AIX denial of service (CVSS 5.5, IBM AIX · IBM VIOS)
- [CVE-2023-5117](https://cve.now/CVE-2023-5117.md): Exposure of Sensitive Information Due to Incompatible Policies in GitLab (CVSS 3.7, GitLab)
- [CVE-2024-52535](https://cve.now/CVE-2024-52535.md): Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symboli (CVSS 7.1, Dell SupportAssist for Home PCs · Dell SupportAssist for Bu…)
- [CVE-2024-39727](https://cve.now/CVE-2024-39727.md): IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing (CVSS 6.1, IBM Engineering Insights)
- [CVE-2024-39725](https://cve.now/CVE-2024-39725.md): IBM Engineering Lifecycle Optimization - Engineering Insights information disclosure (CVSS 5.3, IBM Engineering Insights)
- [CVE-2024-8950](https://cve.now/CVE-2024-8950.md): SQLi in Arne Informatics' Piramit Automation (CVSS 9.9, Arne Informatics Piramit Automation)
- [CVE-2024-52046](https://cve.now/CVE-2024-52046.md): Apache MINA: MINA applications using unbounded deserialization may allow RCE (CVSS 10.0, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2024-10862](https://cve.now/CVE-2024-10862.md): NEX-Forms \<= 8.7.15 - Authenticated (Admin+) SQL Injection (CVSS 4.9, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2024-12335](https://cve.now/CVE-2024-12335.md): Avada Builder \<= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure (CVSS 4.3, themefusion Avada (Fusion) Builder)
- [CVE-2024-11281](https://cve.now/CVE-2024-11281.md): WooCommerce Point of Sale \<= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change (CVSS 9.8, Webkul WooCommerce Point of Sale)
- [CVE-2024-10858](https://cve.now/CVE-2024-10858.md): Jetpack 13.0-14.0 - Unauthenticated DOM-XSS (CVSS 6.1, Jetpack)
- [CVE-2024-12428](https://cve.now/CVE-2024-12428.md): WP Data Access – App, Table, Form and Chart Builder plugin \<= 5.5.22 - Unauthenticated SQL Injection (CVSS 7.5, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2024-12636](https://cve.now/CVE-2024-12636.md): Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages \<= 3.2.7 - Cross-Site Request Forgery (CVSS 4.3, wplegalpages Privacy Policy Generator – WPLP Legal Pages)
- [CVE-2024-12190](https://cve.now/CVE-2024-12190.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder \<= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure (CVSS 4.3, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2024-12272](https://cve.now/CVE-2024-12272.md): WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor \<= 1.3.7 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, wptravelengine WP Travel Engine – Elementor Widgets | Creat…)
- [CVE-2024-12413](https://cve.now/CVE-2024-12413.md): MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution \<= 2.0.00 - Missing Authorization (CVSS 5.3, webwizardsdev MarketKing — Ultimate WooCommerce Multivendor…)
- [CVE-2024-12032](https://cve.now/CVE-2024-12032.md): Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking \<= 2.15.3 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, themefic Tourfic – Travel Booking, Hotel Booking & Car Rent…)
- [CVE-2024-1609](https://cve.now/CVE-2024-1609.md): OPPO Store APP has a WebView component privilege escalation vulnerability. (CVSS 8.7, OPPO OPPP Store)
- [CVE-2024-56430](https://cve.now/CVE-2024-56430.md): OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp. (CVSS 2.9, OpenFHE)
- [CVE-2024-56431](https://cve.now/CVE-2024-56431.md): oc\_huff\_tree\_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.