# CVEs published 2024-12-31

105 CVEs were published on December 31, 2024: 17 critical, 35 high. Days are UTC.

- [CVE-2024-56020](https://cve.now/CVE-2024-56020.md): WordPress SvegliaT Buttons Plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, svegliadesign SvegliaT Buttons)
- [CVE-2024-56021](https://cve.now/CVE-2024-56021.md): WordPress Category Post Shortcode Plugin \<= 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ibnuyahya Category Post Shortcode)
- [CVE-2024-56062](https://cve.now/CVE-2024-56062.md): WordPress Royal Elementor Addons and Templates plugin \<= 1.3.987 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Royal Royal Elementor Addons)
- [CVE-2024-56063](https://cve.now/CVE-2024-56063.md): WordPress Essential Addons for Elementor plugin \<= 6.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Essential Addons for Elementor)
- [CVE-2024-56803](https://cve.now/CVE-2024-56803.md): Ghostty improperly handles window title sequences which can lead to arbitrary command execution (CVSS 5.1, ghostty-org ghostty)
- [CVE-2024-13085](https://cve.now/CVE-2024-13085.md): PHPGurukul Land Record System login.php sql injection (CVSS 6.9, PHPGurukul Land Record System)
- [CVE-2024-13084](https://cve.now/CVE-2024-13084.md): PHPGurukul Land Record System search-property.php sql injection (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13083](https://cve.now/CVE-2024-13083.md): PHPGurukul Land Record System admin-profile.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13082](https://cve.now/CVE-2024-13082.md): PHPGurukul Land Record System search-property.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13081](https://cve.now/CVE-2024-13081.md): PHPGurukul Land Record System contactus.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13080](https://cve.now/CVE-2024-13080.md): PHPGurukul Land Record System aboutus.php cross site scripting (CVSS 5.1, PHPGurukul Land Record System)
- [CVE-2024-13079](https://cve.now/CVE-2024-13079.md): PHPGurukul Land Record System property-details.php sql injection (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13078](https://cve.now/CVE-2024-13078.md): PHPGurukul Land Record System index.php sql injection (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13077](https://cve.now/CVE-2024-13077.md): PHPGurukul Land Record System add-property.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13076](https://cve.now/CVE-2024-13076.md): PHPGurukul Land Record System edit-propertytype.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13075](https://cve.now/CVE-2024-13075.md): PHPGurukul Land Record System add-propertytype.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-13074](https://cve.now/CVE-2024-13074.md): PHPGurukul Land Record System index.php cross site scripting (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2024-55955](https://cve.now/CVE-2024-55955.md): An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 cou (CVSS 6.7, Trend Micro Deep Security)
- [CVE-2024-55917](https://cve.now/CVE-2024-55917.md): An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio (CVSS 7.8, Trend Micro Apex One)
- [CVE-2024-55632](https://cve.now/CVE-2024-55632.md): A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal (CVSS 7.8, Trend Micro Apex One)
- [CVE-2024-55631](https://cve.now/CVE-2024-55631.md): An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations (CVSS 7.8, Trend Micro Apex One)
- [CVE-2024-53647](https://cve.now/CVE-2024-53647.md): Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email ve (CVSS 6.5, Trend Micro ID Security)
- [CVE-2024-52050](https://cve.now/CVE-2024-52050.md): A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected in (CVSS 7.8, Trend Micro Apex One)
- [CVE-2024-52049](https://cve.now/CVE-2024-52049.md): A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio (CVSS 7.8, Trend Micro Apex One)
- [CVE-2024-52048](https://cve.now/CVE-2024-52048.md): A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio (CVSS 7.8, Trend Micro Apex One)
- [CVE-2024-52047](https://cve.now/CVE-2024-52047.md): A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected inst (CVSS 7.5, Trend Micro Apex One)
- [CVE-2024-56198](https://cve.now/CVE-2024-56198.md): path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability (CVSS 9.3, cabraviva path-sanitizer · path-sanitizer)
- [CVE-2024-56802](https://cve.now/CVE-2024-56802.md): Tapir allows DeployKey exposure (CVSS 8.7, PacoVK tapir)
- [CVE-2024-13072](https://cve.now/CVE-2024-13072.md): 1000 Projects Beauty Parlour Management System Customer Detail add-customer-services.php sql injection (CVSS 5.3, 1000 Projects Beauty Parlour Management System)
- [CVE-2024-13070](https://cve.now/CVE-2024-13070.md): CodeAstro Online Food Ordering System Update User Page update\_users.php sql injection (CVSS 5.3, CodeAstro Online Food Ordering System)
- [CVE-2024-25133](https://cve.now/CVE-2024-25133.md): Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation (CVSS 8.8, openshift-hive · github.com/openshift/hive)
- [CVE-2023-6603](https://cve.now/CVE-2023-6603.md): Ffmpeg: null pointer dereference in ffmpeg hls parsing (CVSS 7.5, FFmpeg)
- [CVE-2023-6602](https://cve.now/CVE-2023-6602.md): Ffmpeg: improper handling of input format in tty demuxer of ffmpeg (CVSS 5.3, FFmpeg)
- [CVE-2024-49686](https://cve.now/CVE-2024-49686.md): WordPress Landing Page Cat plugin \<= 1.7.4 - Broken Access Control vulnerability (CVSS 5.4, fatcatapps Landing Page Cat)
- [CVE-2024-49687](https://cve.now/CVE-2024-49687.md): WordPress Smart Manager plugin \<= 8.45.0 - Broken Access Control vulnerability (CVSS 4.3, storeapps Smart Manager)
- [CVE-2024-49694](https://cve.now/CVE-2024-49694.md): WordPress My Wp Brand – Hide menu & Hide Plugin plugin \<= 1.1.2 - Broken Access Control vulnerability (CVSS 5.3, imw3 My Wp Brand)
- [CVE-2024-49698](https://cve.now/CVE-2024-49698.md): WordPress Great Restaurant Menu WP plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 4.3, Best Restaurant Menu by PriceListo)
- [CVE-2024-51667](https://cve.now/CVE-2024-51667.md): WordPress paytium plugin \<= 4.4.10 - Broken Access Control vulnerability (CVSS 4.3, paytiumsupport Paytium)
- [CVE-2024-55995](https://cve.now/CVE-2024-55995.md): WordPress Torod plugin \<= 1.7 - Settings Change vulnerability (CVSS 6.5, Torod Company for Information Technology Torod)
- [CVE-2024-56002](https://cve.now/CVE-2024-56002.md): WordPress Contact Form, Survey & Form Builder – MightyForms plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 6.4, Contact Form, Survey & Form Builder – MightyForms)
- [CVE-2024-56070](https://cve.now/CVE-2024-56070.md): WordPress WP SuperBackup plugin \<= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities (CVSS 7.4, azzaroco WP SuperBackup)
- [CVE-2024-56207](https://cve.now/CVE-2024-56207.md): WordPress EditionGuard for WooCommerce – eBook Sales with DRM plugin \<= 3.4.2 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, EditionGuard for WooCommerce – eBook Sales with DRM)
- [CVE-2024-56206](https://cve.now/CVE-2024-56206.md): WordPress gap-hub-user-role. plugin \<= 3.4.1 - CSRF to Broken Authentication vulnerability (CVSS 8.8, krishankakkar gap-hub-user-role)
- [CVE-2024-56204](https://cve.now/CVE-2024-56204.md): WordPress Sinking Dropdowns plugin \<= 1.25 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, yonisink Sinking Dropdowns)
- [CVE-2024-56203](https://cve.now/CVE-2024-56203.md): WordPress Wayne Audio Player plugin \<= 1.0 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, gholme4 Wayne Audio Player)
- [CVE-2024-56066](https://cve.now/CVE-2024-56066.md): WordPress Agency Toolkit plugin \<= 1.0.23 - Privilege Escalation vulnerability (CVSS 9.8, inspry Agency Toolkit)
- [CVE-2024-56061](https://cve.now/CVE-2024-56061.md): WordPress RepairBuddy plugin \<= 3.8119 - Account Takeover vulnerability (CVSS 8.8, Ateeq Rafeeq RepairBuddy)
- [CVE-2024-56045](https://cve.now/CVE-2024-56045.md): WordPress WPLMS plugin \< 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability (CVSS 9.3, VibeThemes WPLMS)
- [CVE-2024-56044](https://cve.now/CVE-2024-56044.md): WordPress WPLMS plugin \<= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability (CVSS 9.8, VibeThemes WPLMS)
- [CVE-2024-56043](https://cve.now/CVE-2024-56043.md): WordPress WPLMS plugin \<= 1.9.9 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, VibeThemes WPLMS)
- [CVE-2024-56040](https://cve.now/CVE-2024-56040.md): WordPress VibeBP plugin \<= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, VibeThemes VibeBP)
- [CVE-2024-56042](https://cve.now/CVE-2024-56042.md): WordPress WPLMS plugin \< 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, VibeThemes WPLMS)
- [CVE-2024-56041](https://cve.now/CVE-2024-56041.md): WordPress VibeBP plugin \< 1.9.9.5.1 - SQL Injection vulnerability (CVSS 8.5, VibeThemes VibeBP)
- [CVE-2024-56039](https://cve.now/CVE-2024-56039.md): WordPress VibeBP plugin \< 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, VibeThemes VibeBP)
- [CVE-2024-56064](https://cve.now/CVE-2024-56064.md): WordPress WP SuperBackup plugin \<= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, azzaroco WP SuperBackup)
- [CVE-2024-56046](https://cve.now/CVE-2024-56046.md): WordPress WPLMS plugin \<= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, VibeThemes WPLMS)
- [CVE-2024-56068](https://cve.now/CVE-2024-56068.md): WordPress WP SuperBackup plugin \<= 2.3.3 - Subscriber+ PHP Object Injection vulnerability (CVSS 7.5, azzaroco WP SuperBackup)
- [CVE-2024-55991](https://cve.now/CVE-2024-55991.md): WordPress CRM Plugin – WP-CRM System plugin \<= 3.2.9.1 - Broken Access Control vulnerability (CVSS 6.5, Mario Peshev WP-CRM System)
- [CVE-2024-56031](https://cve.now/CVE-2024-56031.md): WordPress Smart Shopify Product plugin \<= 1.0.2 - Arbitrary Content Deletion vulnerability (CVSS 6.5, Yulio Aleman Jimenez Smart Shopify Product)
- [CVE-2024-56067](https://cve.now/CVE-2024-56067.md): WordPress WP SuperBackup plugin \<= 2.3.3 - Unauthenticated Backup File Download Vulnerability (CVSS 7.5, azzaroco WP SuperBackup)
- [CVE-2023-48775](https://cve.now/CVE-2023-48775.md): WordPress WP CleanFix plugin \<= 5.6.2 - Broken Access Control vulnerability (CVSS 5.3, Gfazioli WP Cleanfix)
- [CVE-2023-50850](https://cve.now/CVE-2023-50850.md): WordPress Woo Subscriptions plugin \< 5.8.0 - Broken Access Control vulnerability (CVSS 4.3, WooCommerce Subscriptions)
- [CVE-2024-56071](https://cve.now/CVE-2024-56071.md): WordPress Simple Dashboard plugin \<= 2.0 - Privilege Escalation vulnerability (CVSS 9.8, mikeleembruggen Simple Dashboard)
- [CVE-2024-56205](https://cve.now/CVE-2024-56205.md): WordPress AI Magic – SEO Content Generator & Article Writer plugin \<= 1.0.4 - Privilege Escalation vulnerability (CVSS 9.8, SunnyKai AI Magic)
- [CVE-2024-13061](https://cve.now/CVE-2024-13061.md): 2100 Technology Electronic Official Document Management System - Authentication Bypass (CVSS 9.8, 2100 Technology Electronic Official Document Management Sys…)
- [CVE-2024-13069](https://cve.now/CVE-2024-13069.md): SourceCodester Multi Role Login System add-user.php cross site scripting (CVSS 5.3, SourceCodester Multi Role Login System)
- [CVE-2024-56209](https://cve.now/CVE-2024-56209.md): WordPress Kleo theme \< 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SeventhQueen Kleo)
- [CVE-2024-56210](https://cve.now/CVE-2024-56210.md): WordPress UserPro plugin \<= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DeluxeThemes Userpro)
- [CVE-2024-12105](https://cve.now/CVE-2024-12105.md): WhatsUp Gold - SnmpExtendedActiveMonitor path traversal (CVSS 6.5, Progress Software WhatsUp Gold)
- [CVE-2024-12106](https://cve.now/CVE-2024-12106.md): WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication (CVSS 9.4, Progress Software WhatsUp Gold)
- [CVE-2024-12108](https://cve.now/CVE-2024-12108.md): WhatsUp Gold - Public API signing key rotation issue (CVSS 9.6, Progress Software WhatsUp Gold)
- [CVE-2024-56221](https://cve.now/CVE-2024-56221.md): WordPress WPMozo Addons Lite for Elementor plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Elicus WPMozo Addons Lite for Elementor)
- [CVE-2024-56223](https://cve.now/CVE-2024-56223.md): WordPress Gulri Slider plugin \<= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fahad Mahmood Gulri Slider)
- [CVE-2024-56224](https://cve.now/CVE-2024-56224.md): WordPress Ledenbeheer plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ledenbeheer)
- [CVE-2024-56226](https://cve.now/CVE-2024-56226.md): WordPress Royal Elementor Addons plugin \<= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Royal Royal Elementor Addons)
- [CVE-2024-56228](https://cve.now/CVE-2024-56228.md): WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin \<= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPFactory Wishlist for WooCommerce)
- [CVE-2024-56231](https://cve.now/CVE-2024-56231.md): WordPress SaasPricing plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Debuggers Studio SaasPricing)
- [CVE-2024-56233](https://cve.now/CVE-2024-56233.md): WordPress Kintpv Wooconnect plugin \<= 8.129 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kinhelios KinTPV WooConnect)
- [CVE-2024-56234](https://cve.now/CVE-2024-56234.md): WordPress VW Automobile Lite theme \<= 2.1 - Broken Access Control vulnerability (CVSS 5.4, vowelweb VW Automobile Lite)
- [CVE-2024-56227](https://cve.now/CVE-2024-56227.md): WordPress Royal Elementor Addons plugin \<= 1.7.1001 - Broken Access Control vulnerability (CVSS 4.3, WP Royal Royal Elementor Addons)
- [CVE-2024-56225](https://cve.now/CVE-2024-56225.md): WordPress Premium Addons for Elementor plugin \<= 4.10.56 - Broken Access Control vulnerability (CVSS 5.4, Leap13 Premium Addons for Elementor)
- [CVE-2024-56219](https://cve.now/CVE-2024-56219.md): WordPress Widget Options plugin \<= 4.0.6.1 - Broken Access Control vulnerability (CVSS 4.3, Marketing Fire Widget Options)
- [CVE-2024-56217](https://cve.now/CVE-2024-56217.md): WordPress Download Manager plugin \<= 3.3.03 - Broken Access Control vulnerability (CVSS 4.3, Shahjada Download Manager)
- [CVE-2024-56215](https://cve.now/CVE-2024-56215.md): WordPress Member Directory and Contact Form plugin \<= 1.7.0 - Broken Access Control vulnerability (CVSS 4.3, DBAR Productions Member Directory and Contact Form)
- [CVE-2024-56235](https://cve.now/CVE-2024-56235.md): WordPress Coupon plugin \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vicky Kumar Coupon)
- [CVE-2024-56256](https://cve.now/CVE-2024-56256.md): WordPress Embed PDF Viewer plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Andy Fragen Embed PDF Viewer)
- [CVE-2024-56265](https://cve.now/CVE-2024-56265.md): WordPress WooCommerce - PDF Vouchers plugin \< 4.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpweb WooCommerce PDF Vouchers)
- [CVE-2024-56218](https://cve.now/CVE-2024-56218.md): WordPress Contact Form 7 - Dynamic Text Extension plugin \<= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, sevenspark Contact Form 7 – Dynamic Text Extension)
- [CVE-2024-56222](https://cve.now/CVE-2024-56222.md): WordPress CodeBard Help Desk plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, CodeBard Help Desk)
- [CVE-2024-56229](https://cve.now/CVE-2024-56229.md): WordPress SearchIQ plugin \<= 4.6 - Cross-Site Requst Forgery (CSRF) vulnerability (CVSS 4.3, SearchIQ)
- [CVE-2024-56232](https://cve.now/CVE-2024-56232.md): WordPress WP Nice Loader plugin \<= 0.1.0.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Alex Volkov WP Nice Loader)
- [CVE-2024-56220](https://cve.now/CVE-2024-56220.md): WordPress SSL Wireless SMS Notification plugin \<= 3.6.0 - Privilege Escalation vulnerability (CVSS 9.8, sslplugins SSL Wireless SMS Notification)
- [CVE-2024-56212](https://cve.now/CVE-2024-56212.md): WordPress UserPro plugin \<= 5.1.9 - SQL Injection vulnerability (CVSS 8.5, DeluxeThemes Userpro)
- [CVE-2024-56211](https://cve.now/CVE-2024-56211.md): WordPress UserPro plugin \<= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability (CVSS 8.8, DeluxeThemes Userpro)
- [CVE-2024-56213](https://cve.now/CVE-2024-56213.md): WordPress Eventin plugin \<= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability (CVSS 6.5, Arraytics Eventin)
- [CVE-2024-56214](https://cve.now/CVE-2024-56214.md): WordPress UserPro plugin \<= 5.1.9 - Local File Inclusion vulnerability (CVSS 8.3, DeluxeThemes Userpro)
- [CVE-2024-56216](https://cve.now/CVE-2024-56216.md): WordPress Themify Builder plugin \<= 7.6.3 - Local File Inclusion vulnerability (CVSS 6.5, themifyme Themify Builder)
- [CVE-2024-56230](https://cve.now/CVE-2024-56230.md): WordPress Dynamic Product Category Grid, Slider for WooCommerce plugin \<= 1.1.3 - Local File Inclusion vulnerability (CVSS 7.5, Maidul Dynamic Product Category Grid, Slider for WooCommerce)
- [CVE-2024-13067](https://cve.now/CVE-2024-13067.md): CodeAstro Online Food Ordering System All Users Page all\_users.php access control (CVSS 6.9, CodeAstro Online Food Ordering System)
- [CVE-2024-49422](https://cve.now/CVE-2024-49422.md): Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by ha (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2024-11972](https://cve.now/CVE-2024-11972.md): Hunk Companion \< 1.9.0 - Unauthenticated Plugin Installation (CVSS 9.8, Hunk Companion)
- [CVE-2024-45497](https://cve.now/CVE-2024-45497.md): Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials (CVSS 7.6, openshift · Red Hat OpenShift Container Platform +1)
- [CVE-2024-13040](https://cve.now/CVE-2024-13040.md): Quanta Computer QOCA aim - Authorization Bypass (CVSS 8.8, Quanta Computer QOCA aim)
- [CVE-2024-12839](https://cve.now/CVE-2024-12839.md): Changing Information Technology CGFIDO - Authentication Bypass (CVSS 8.8, Changing Information Technology CGFIDO)
- [CVE-2024-12838](https://cve.now/CVE-2024-12838.md): Changing Information Technology CGFIDO - Authentication Bypass (CVSS 8.8, Changing Information Technology CGFIDO)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.