Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-58304 | medium | 6.1 | No | SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticate... | 2026-10-27 |
| CVE-2024-58297 | medium | 5.4 | No | PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject mal... | 2026-10-27 |
| CVE-2024-58294 | high | 8.8 | No | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credenti... | 2026-10-27 |
| CVE-2024-58293 | not reported | — | No | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template express... | 2026-10-27 |
| CVE-2024-58291 | not reported | — | No | Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in f... | 2026-10-27 |
| CVE-2024-58289 | medium | 5.4 | No | Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into... | 2026-10-27 |
| CVE-2024-58287 | high | 8.8 | No | reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated at... | 2026-10-27 |
| CVE-2024-2105 | medium | 6.5 | No | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected de... | 2026-10-27 |
| CVE-2024-5540 | not reported | — | No | The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allo... | 2026-10-27 |
| CVE-2024-44662 | medium | 6.5 | No | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. | 2026-10-27 |
| CVE-2024-44653 | medium | 6.5 | No | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_login.php. | 2026-10-27 |
| CVE-2024-46336 | medium | 6.1 | No | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. | 2026-10-27 |
| CVE-2024-46334 | medium | 6.1 | No | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLog... | 2026-10-27 |
| CVE-2024-44652 | medium | 6.5 | No | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_address... | 2026-10-27 |
| CVE-2024-44648 | medium | 6.5 | No | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. | 2026-10-27 |
| CVE-2024-44647 | medium | 6.1 | No | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. | 2026-10-27 |
| CVE-2024-55016 | medium | 6.5 | No | PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. | 2026-10-27 |
| CVE-2024-44639 | medium | 6.5 | No | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subj... | 2026-10-27 |
| CVE-2024-44636 | medium | 6.5 | No | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. | 2026-10-27 |
| CVE-2024-44635 | medium | 6.1 | No | PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.ph... | 2026-10-27 |