Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-58313 | high | 7.2 | No | xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload a... | 2026-10-27 |
| CVE-2024-58312 | high | 7.5 | No | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulatin... | 2026-10-27 |
| CVE-2024-58309 | critical | 9.8 | No | xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by inject... | 2026-10-27 |
| CVE-2024-58307 | high | 8.8 | No | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to... | 2026-10-27 |
| CVE-2024-58306 | not reported | — | No | minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET reque... | 2026-10-27 |
| CVE-2024-58304 | medium | 6.1 | No | SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticate... | 2026-10-27 |
| CVE-2024-58297 | medium | 5.4 | No | PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject mal... | 2026-10-27 |
| CVE-2024-58294 | high | 8.8 | No | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credenti... | 2026-10-27 |
| CVE-2024-58293 | not reported | — | No | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template express... | 2026-10-27 |
| CVE-2024-58291 | not reported | — | No | Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in f... | 2026-10-27 |
| CVE-2024-58289 | medium | 5.4 | No | Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into... | 2026-10-27 |
| CVE-2024-58287 | high | 8.8 | No | reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated at... | 2026-10-27 |
| CVE-2024-2105 | medium | 6.5 | No | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected de... | 2026-10-27 |
| CVE-2024-5540 | not reported | — | No | The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allo... | 2026-10-27 |
| CVE-2024-44662 | medium | 6.5 | No | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. | 2026-10-27 |
| CVE-2024-44653 | medium | 6.5 | No | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_login.php. | 2026-10-27 |
| CVE-2024-46336 | medium | 6.1 | No | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. | 2026-10-27 |
| CVE-2024-46334 | medium | 6.1 | No | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLog... | 2026-10-27 |
| CVE-2024-44652 | medium | 6.5 | No | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_address... | 2026-10-27 |
| CVE-2024-44648 | medium | 6.5 | No | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. | 2026-10-27 |