# CVEs published 2024-12-26 66 CVEs were published on December 26, 2024: 1 critical, 6 high. Days are UTC. - [CVE-2024-12969](https://cve.now/CVE-2024-12969.md): code-projects Hospital Management System Login index.php sql injection (CVSS 6.9, code-projects Hospital Management System) - [CVE-2024-12968](https://cve.now/CVE-2024-12968.md): code-projects Job Recruitment \_all\_edits.php edit\_jobpost sql injection (CVSS 6.9, code-projects Job Recruitment) - [CVE-2024-56361](https://cve.now/CVE-2024-56361.md): Stored Cross-Site Scripting (XSS) in lgsl v7.0 (CVSS 5.3, tltneon lgsl · tltneon/lgsl) - [CVE-2024-55950](https://cve.now/CVE-2024-55950.md): Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby (CVSS 8.6, Eugeny tabby) - [CVE-2024-53850](https://cve.now/CVE-2024-53850.md): The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation (CVSS 8.2, pluginsGLPI addressing) - [CVE-2024-45805](https://cve.now/CVE-2024-45805.md): OpenCTI leaks support information due to inadequate access control (CVSS 4.3, OpenCTI-Platform opencti · pycti) - [CVE-2024-12967](https://cve.now/CVE-2024-12967.md): code-projects Job Recruitment \_all\_edits.php fln\_update sql injection (CVSS 6.9, code-projects Job Recruitment) - [CVE-2024-45600](https://cve.now/CVE-2024-45600.md): Fields GLPI plugin has an Authenticated SQL Injection (CVSS 7.7, pluginsGLPI fields) - [CVE-2024-12966](https://cve.now/CVE-2024-12966.md): code-projects Job Recruitment \_all\_edits.php cn\_update sql injection (CVSS 6.9, code-projects Job Recruitment) - [CVE-2024-56510](https://cve.now/CVE-2024-56510.md): Marp Core allows XSS by improper neutralization of HTML sanitization (CVSS 5.3, marp-team marp-core · @marp-team/marp-core) - [CVE-2024-12965](https://cve.now/CVE-2024-12965.md): 1000 Projects Portfolio Management System MCA update\_ex\_detail.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12964](https://cve.now/CVE-2024-12964.md): 1000 Projects Daily College Class Work Report Book login.php sql injection (CVSS 6.9, 1000 Projects Daily College Class Work Report Book) - [CVE-2024-12963](https://cve.now/CVE-2024-12963.md): code-projects Job Recruitment \_all\_edits.php add\_xp sql injection (CVSS 6.9, code-projects Job Recruitment) - [CVE-2024-12962](https://cve.now/CVE-2024-12962.md): code-projects Job Recruitment \_all\_edits.php sql injection (CVSS 6.9, code-projects Job Recruitment) - [CVE-2024-12961](https://cve.now/CVE-2024-12961.md): 1000 Projects Portfolio Management System MCA update\_ach\_details.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12960](https://cve.now/CVE-2024-12960.md): 1000 Projects Portfolio Management System MCA update\_edu\_details.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12959](https://cve.now/CVE-2024-12959.md): 1000 Projects Portfolio Management System MCA update\_personal\_details.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA) - [CVE-2024-51540](https://cve.now/CVE-2024-51540.md): Dell ECS, versions prior to 3.8.1.3 contains an arithmetic overflow vulnerability exists in retention period handling of ECS. (CVSS 8.1, Dell ECS) - [CVE-2024-12908](https://cve.now/CVE-2024-12908.md): Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, (CVSS 6.9, Delinea Secret Server) - [CVE-2024-12958](https://cve.now/CVE-2024-12958.md): 1000 Projects Portfolio Management System MCA update\_pro\_details.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12956](https://cve.now/CVE-2024-12956.md): 1000 Projects Portfolio Management System MCA add\_achievement\_details.php unrestricted upload (CVSS 5.3, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12955](https://cve.now/CVE-2024-12955.md): PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery (CVSS 6.9, PHPGurukul Blood Bank & Donor Management System) - [CVE-2024-12954](https://cve.now/CVE-2024-12954.md): 1000 Projects Portfolio Management System MCA update\_ach.php unrestricted upload (CVSS 5.3, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12953](https://cve.now/CVE-2024-12953.md): 1000 Projects Portfolio Management System MCA update\_pd\_process.php unrestricted upload (CVSS 5.3, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12952](https://cve.now/CVE-2024-12952.md): melMass comfy\_mtb Dependency endpoint.py run\_command code injection (CVSS 5.3, melMass comfy\_mtb) - [CVE-2024-12951](https://cve.now/CVE-2024-12951.md): 1000 Projects Portfolio Management System MCA add\_personal\_details.php unrestricted upload (CVSS 5.3, 1000 Projects Portfolio Management System MCA) - [CVE-2024-47150](https://cve.now/CVE-2024-47150.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 3.3, Honor Magic OS) - [CVE-2024-47149](https://cve.now/CVE-2024-47149.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service excepti (CVSS 3.3, Honor Magic OS) - [CVE-2024-47148](https://cve.now/CVE-2024-47148.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service excepti (CVSS 4.0, Honor Magic OS) - [CVE-2024-12950](https://cve.now/CVE-2024-12950.md): code-projects/projectworlds Travel Management System subcat.php sql injection (CVSS 5.3, code-projects Travel Management System · projectworlds Trav…) - [CVE-2024-47157](https://cve.now/CVE-2024-47157.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service excepti (CVSS 2.9, Honor Magic OS) - [CVE-2024-47155](https://cve.now/CVE-2024-47155.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 5.5, Honor Magic OS) - [CVE-2024-47154](https://cve.now/CVE-2024-47154.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 5.5, Honor Magic OS) - [CVE-2024-47153](https://cve.now/CVE-2024-47153.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 6.2, Honor Magic OS) - [CVE-2024-12949](https://cve.now/CVE-2024-12949.md): code-projects Travel Management System package.php sql injection (CVSS 5.3, code-projects Travel Management System) - [CVE-2024-8992](https://cve.now/CVE-2024-8992.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 4.0, Honor Magic OS) - [CVE-2024-8993](https://cve.now/CVE-2024-8993.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 6.2, Honor Magic OS) - [CVE-2024-8994](https://cve.now/CVE-2024-8994.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 6.2, Honor Magic OS) - [CVE-2024-47151](https://cve.now/CVE-2024-47151.md): Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution (CVSS 6.3, Honor Magic OS) - [CVE-2024-47156](https://cve.now/CVE-2024-47156.md): Information Leak Vulnerability in Honor Product (CVSS 3.3, Honor MagicOS) - [CVE-2024-12948](https://cve.now/CVE-2024-12948.md): code-projects Travel Management System detail.php sql injection (CVSS 5.3, code-projects Travel Management System) - [CVE-2024-12947](https://cve.now/CVE-2024-12947.md): Codezips Hospital Management System invo.php sql injection (CVSS 5.3, Codezips Hospital Management System) - [CVE-2024-12946](https://cve.now/CVE-2024-12946.md): 1000 Projects Attendance Tracking Management System admin\_action.php sql injection (CVSS 6.9, 1000 Projects Attendance Tracking Management System) - [CVE-2024-12945](https://cve.now/CVE-2024-12945.md): code-projects Simple Car Rental System account.php sql injection (CVSS 6.9, code-projects Simple Car Rental System) - [CVE-2023-7300](https://cve.now/CVE-2023-7300.md): Huawei Home Music System has a path traversal vulnerability. (CVSS 8.0, Huawei HarmonyOS AILife Solution) - [CVE-2024-12944](https://cve.now/CVE-2024-12944.md): CodeAstro House Rental Management System signin.php sql injection (CVSS 6.9, CodeAstro House Rental Management System) - [CVE-2024-12943](https://cve.now/CVE-2024-12943.md): CodeAstro House Rental Management System ownersignup.php sql injection (CVSS 6.9, CodeAstro House Rental Management System) - [CVE-2024-12942](https://cve.now/CVE-2024-12942.md): 1000 Projects Portfolio Management System MCA admin\_login.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA) - [CVE-2024-12941](https://cve.now/CVE-2024-12941.md): CodeAstro Blood Donor Management System deletedannounce.php sql injection (CVSS 5.3, CodeAstro Blood Donor Management System) - [CVE-2024-12940](https://cve.now/CVE-2024-12940.md): 1000 Projects Attendance Tracking Management System student\_action.php sql injection (CVSS 6.9, 1000 Projects Attendance Tracking Management System) - [CVE-2024-12939](https://cve.now/CVE-2024-12939.md): code-projects Job Recruitment \_all\_edits.php add\_edu sql injection (CVSS 5.3, code-projects Job Recruitment) - [CVE-2024-12938](https://cve.now/CVE-2024-12938.md): code-projects Simple Admin Panel updateOrderStatus.php sql injection (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-11223](https://cve.now/CVE-2024-11223.md): WPForms \< 1.9.2.3 - Admin+ Stored XSS (CVSS 4.7, WPForms) - [CVE-2024-10903](https://cve.now/CVE-2024-10903.md): Broken Link Checker \< 2.4.2 - Admin+ SSRF (CVSS 4.7, Broken Link Checker) - [CVE-2024-12937](https://cve.now/CVE-2024-12937.md): code-projects Simple Admin Panel addVariationController.php sql injection (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12936](https://cve.now/CVE-2024-12936.md): code-projects Simple Admin Panel catDeleteController.php sql injection (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12935](https://cve.now/CVE-2024-12935.md): code-projects Simple Admin Panel editItemForm.php sql injection (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12652](https://cve.now/CVE-2024-12652.md): Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection') (CVSS 9.3, Intumit SmartRobot′s Conversational AI Platform) - [CVE-2024-12934](https://cve.now/CVE-2024-12934.md): code-projects Simple Admin Panel updateItemController.php sql injection (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12933](https://cve.now/CVE-2024-12933.md): code-projects Simple Admin Panel updateItemController.php cross site scripting (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12932](https://cve.now/CVE-2024-12932.md): code-projects Simple Admin Panel addSizeController.php cross site scripting (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12931](https://cve.now/CVE-2024-12931.md): code-projects Simple Admin Panel addCatController.php sql injection (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12930](https://cve.now/CVE-2024-12930.md): code-projects Simple Admin Panel addCatController.php cross site scripting (CVSS 5.3, code-projects Simple Admin Panel) - [CVE-2024-12929](https://cve.now/CVE-2024-12929.md): code-projects Student Management System addCatController.php sql injection (CVSS 5.3, code-projects Student Management System) - [CVE-2024-54907](https://cve.now/CVE-2024-54907.md): TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc. (CVSS 8.8) - [CVE-2024-56433](https://cve.now/CVE-2024-56433.md): shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user (CVSS 3.6, shadow-maint shadow-utils) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-12-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.