# Vulnerabilities published in 2024


- [CVE-2024-9942](https://insights.sbomify.com/CVE-2024-9942/): WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-9941](https://insights.sbomify.com/CVE-2024-9941/): WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2024-9940](https://insights.sbomify.com/CVE-2024-9940/): Calculated Fields Form <= 5.2.45 - HTML Injection (medium 5.3)
- [CVE-2024-9939](https://insights.sbomify.com/CVE-2024-9939/): WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php (high 7.5)
- [CVE-2024-9938](https://insights.sbomify.com/CVE-2024-9938/): Bounce Handler MailPoet 3 <= 1.3.21 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9937](https://insights.sbomify.com/CVE-2024-9937/): Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9936](https://insights.sbomify.com/CVE-2024-9936/): Race condition in Firefox (medium 6.5)
- [CVE-2024-9935](https://insights.sbomify.com/CVE-2024-9935/): PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download (high 7.5)
- [CVE-2024-9934](https://insights.sbomify.com/CVE-2024-9934/): Wp-ImageZoom <= 1.1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-9933](https://insights.sbomify.com/CVE-2024-9933/): WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check (critical 9.8)
- [CVE-2024-9932](https://insights.sbomify.com/CVE-2024-9932/): Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-9931](https://insights.sbomify.com/CVE-2024-9931/): Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator (critical 9.8)
- [CVE-2024-9930](https://insights.sbomify.com/CVE-2024-9930/): Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypass (critical 9.8)
- [CVE-2024-9929](https://insights.sbomify.com/CVE-2024-9929/): Information disclosure in NSD570 Teleprotection Equipment (medium 4.3)
- [CVE-2024-9928](https://insights.sbomify.com/CVE-2024-9928/): Auth bypass in NSD570 Teleprotection Equipment (medium 5.3)
- [CVE-2024-9927](https://insights.sbomify.com/CVE-2024-9927/): WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal (high 7.2)
- [CVE-2024-9926](https://insights.sbomify.com/CVE-2024-9926/): Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access (medium 4.3)
- [CVE-2024-9925](https://insights.sbomify.com/CVE-2024-9925/): SQL injection in QPLANT by TAI Smart Factory (critical 9.8)
- [CVE-2024-9924](https://insights.sbomify.com/CVE-2024-9924/): Hgiga OAKlouds - Arbitrary File Read And Delete (critical 9.8)
- [CVE-2024-9923](https://insights.sbomify.com/CVE-2024-9923/): TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversal (medium 4.9)
- [CVE-2024-9922](https://insights.sbomify.com/CVE-2024-9922/): TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal (high 7.5)
- [CVE-2024-9921](https://insights.sbomify.com/CVE-2024-9921/): TEAMPLUS TECHNOLOGY Team+ - SQL Injection (critical 9.8)
- [CVE-2024-9920](https://insights.sbomify.com/CVE-2024-9920/): Unrestricted File Upload and Execution in parisneo/lollms-webui (medium 6.6)
- [CVE-2024-9919](https://insights.sbomify.com/CVE-2024-9919/): Missing Authentication Check in parisneo/lollms-webui (high 8.4)
- [CVE-2024-9918](https://insights.sbomify.com/CVE-2024-9918/): HuangDou UTCMS sql.php RunSql sql injection (medium 5.1)
- [CVE-2024-9917](https://insights.sbomify.com/CVE-2024-9917/): HuangDou UTCMS template_creat.php deserialization (medium 5.3)
- [CVE-2024-9916](https://insights.sbomify.com/CVE-2024-9916/): HuangDou UTCMS cli.php os command injection (medium 6.9)
- [CVE-2024-9915](https://insights.sbomify.com/CVE-2024-9915/): D-Link DIR-619L B1 formVirtualServ buffer overflow (high 8.7)
- [CVE-2024-9914](https://insights.sbomify.com/CVE-2024-9914/): D-Link DIR-619L B1 formSetWizardSelectMode buffer overflow (high 8.7)
- [CVE-2024-9913](https://insights.sbomify.com/CVE-2024-9913/): D-Link DIR-619L B1 formSetRoute buffer overflow (high 8.7)
- [CVE-2024-9912](https://insights.sbomify.com/CVE-2024-9912/): D-Link DIR-619L B1 formSetQoS buffer overflow (high 8.7)
- [CVE-2024-9911](https://insights.sbomify.com/CVE-2024-9911/): D-Link DIR-619L B1 formSetPortTr buffer overflow (high 8.7)
- [CVE-2024-9910](https://insights.sbomify.com/CVE-2024-9910/): D-Link DIR-619L B1 formSetPassword buffer overflow (high 8.7)
- [CVE-2024-9909](https://insights.sbomify.com/CVE-2024-9909/): D-Link DIR-619L B1 formSetMuti buffer overflow (high 8.7)
- [CVE-2024-9908](https://insights.sbomify.com/CVE-2024-9908/): D-Link DIR-619L B1 formSetMACFilter buffer overflow (medium 5.1)
- [CVE-2024-9907](https://insights.sbomify.com/CVE-2024-9907/): QileCMS Verification Code Forget.php sendEmail password recovery (medium 6.3)
- [CVE-2024-9906](https://insights.sbomify.com/CVE-2024-9906/): SourceCodester Online Eyewear Shop cross site scripting (medium 5.3)
- [CVE-2024-9905](https://insights.sbomify.com/CVE-2024-9905/): SourceCodester Online Eyewear Shop sql injection (medium 5.3)
- [CVE-2024-9904](https://insights.sbomify.com/CVE-2024-9904/): 07FLYCMS/07FLY-CMS/07FlyCRM pictureUpload unrestricted upload (medium 5.1)
- [CVE-2024-9903](https://insights.sbomify.com/CVE-2024-9903/): 07FLYCMS/07FLY-CMS/07FlyCRM fileUpload unrestricted upload (medium 5.1)
- [CVE-2024-9902](https://insights.sbomify.com/CVE-2024-9902/): Ansible-core: ansible-core user may read/write unauthorized content (medium 6.3)
- [CVE-2024-9900](https://insights.sbomify.com/CVE-2024-9900/): Cross-Site Scripting (XSS) in mudler/localai (medium 5.4)
- [CVE-2024-9898](https://insights.sbomify.com/CVE-2024-9898/): Parallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode (medium 6.4)
- [CVE-2024-9897](https://insights.sbomify.com/CVE-2024-9897/): Cross-site scripting in StreamWeasels Twitch Integration (medium 6.4)
- [CVE-2024-9896](https://insights.sbomify.com/CVE-2024-9896/): Cross-site scripting in Forumax – AI Powered Advanced Community Forum Plugin (medium 6.1)
- [CVE-2024-9895](https://insights.sbomify.com/CVE-2024-9895/): Cross-site scripting in Smart Online Order for Clover (medium 6.4)
- [CVE-2024-9894](https://insights.sbomify.com/CVE-2024-9894/): code-projects Blood Bank System reset.php sql injection (medium 5.3)
- [CVE-2024-9893](https://insights.sbomify.com/CVE-2024-9893/): Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider (critical 9.8)
- [CVE-2024-9892](https://insights.sbomify.com/CVE-2024-9892/): Add Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-9891](https://insights.sbomify.com/CVE-2024-9891/): Missing authorization in MultiLine Files for Contact Form 7 (medium 4.3)
- [CVE-2024-9890](https://insights.sbomify.com/CVE-2024-9890/): User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass (high 8.8)
- [CVE-2024-9889](https://insights.sbomify.com/CVE-2024-9889/): ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure (medium 4.3)
- [CVE-2024-9888](https://insights.sbomify.com/CVE-2024-9888/): ElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-9887](https://insights.sbomify.com/CVE-2024-9887/): Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection (high 7.2)
- [CVE-2024-9886](https://insights.sbomify.com/CVE-2024-9886/): WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9885](https://insights.sbomify.com/CVE-2024-9885/): Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9884](https://insights.sbomify.com/CVE-2024-9884/): T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9883](https://insights.sbomify.com/CVE-2024-9883/): Pods < 3.2.7.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9882](https://insights.sbomify.com/CVE-2024-9882/): Salon Booking System < 10.9.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9881](https://insights.sbomify.com/CVE-2024-9881/): LearnPress < 4.2.7.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9879](https://insights.sbomify.com/CVE-2024-9879/): Website File Changes < 2.1.1 - Authenticated SQL Injection (medium 5.4)
- [CVE-2024-9878](https://insights.sbomify.com/CVE-2024-9878/): Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-9877](https://insights.sbomify.com/CVE-2024-9877/): Sensitive information submitted using GET method (medium 5.3)
- [CVE-2024-9876](https://insights.sbomify.com/CVE-2024-9876/): Application is vulnerable to Privilege escalation (high 8.5)
- [CVE-2024-9875](https://insights.sbomify.com/CVE-2024-9875/): Privilege escalation in Okta Privileged Access Server Agent (SFTD) (high 7.1)
- [CVE-2024-9874](https://insights.sbomify.com/CVE-2024-9874/): WordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection (medium 4.9)
- [CVE-2024-9873](https://insights.sbomify.com/CVE-2024-9873/): Community by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-9872](https://insights.sbomify.com/CVE-2024-9872/): Missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita (medium 5.4)
- [CVE-2024-9870](https://insights.sbomify.com/CVE-2024-9870/): Unintended Proxy or Intermediary ('Confused Deputy') in GitLab (medium 4.3)
- [CVE-2024-9868](https://insights.sbomify.com/CVE-2024-9868/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 5.4)
- [CVE-2024-9867](https://insights.sbomify.com/CVE-2024-9867/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 5.4)
- [CVE-2024-9866](https://insights.sbomify.com/CVE-2024-9866/): Cross-site scripting in Event Tickets with Ticket Scanner (medium 5.4)
- [CVE-2024-9865](https://insights.sbomify.com/CVE-2024-9865/): Cross-site scripting in EventPrime – Events Calendar, Bookings and Tickets (medium 6.1)
- [CVE-2024-9864](https://insights.sbomify.com/CVE-2024-9864/): EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-9863](https://insights.sbomify.com/CVE-2024-9863/): Privilege escalation in Miniorange OTP Verification with Firebase (critical 9.8)
- [CVE-2024-9862](https://insights.sbomify.com/CVE-2024-9862/): Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change (critical 9.8)
- [CVE-2024-9861](https://insights.sbomify.com/CVE-2024-9861/): Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass (high 8.1)
- [CVE-2024-9860](https://insights.sbomify.com/CVE-2024-9860/): Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import (medium 5.4)
- [CVE-2024-9859](https://insights.sbomify.com/CVE-2024-9859/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-9858](https://insights.sbomify.com/CVE-2024-9858/): Insecure user permissions in Google Cloud Migrate to Containers for Windows (medium 5.9)
- [CVE-2024-9856](https://insights.sbomify.com/CVE-2024-9856/): 07FLYCMS/07FLY-CMS/07FlyCRM System Settings Page cross site scripting (medium 5.1)
- [CVE-2024-9855](https://insights.sbomify.com/CVE-2024-9855/): 07FLYCMS/07FLY-CMS/07FlyCRM Module Plug-In sysmodule_1 uploadFile unrestricted upload (medium 5.1)
- [CVE-2024-9853](https://insights.sbomify.com/CVE-2024-9853/): ID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9852](https://insights.sbomify.com/CVE-2024-9852/): Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32 (high 7.8)
- [CVE-2024-9851](https://insights.sbomify.com/CVE-2024-9851/): LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9850](https://insights.sbomify.com/CVE-2024-9850/): SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9849](https://insights.sbomify.com/CVE-2024-9849/): Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2024-9848](https://insights.sbomify.com/CVE-2024-9848/): Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9847](https://insights.sbomify.com/CVE-2024-9847/): Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress (high 8.0)
- [CVE-2024-9846](https://insights.sbomify.com/CVE-2024-9846/): Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-9845](https://insights.sbomify.com/CVE-2024-9845/): Privilege escalation in Automation (high 7.8)
- [CVE-2024-9844](https://insights.sbomify.com/CVE-2024-9844/): Security feature bypass in Connect Secure (high 7.1)
- [CVE-2024-9843](https://insights.sbomify.com/CVE-2024-9843/): Memory corruption in Secure Access Client (medium 5.0)
- [CVE-2024-9842](https://insights.sbomify.com/CVE-2024-9842/): Misconfiguration in Secure Access Client (high 7.3)
- [CVE-2024-9841](https://insights.sbomify.com/CVE-2024-9841/): OpenText ArcSight Management Center and ArcSight Platform Stored XSS (high 7.0)
- [CVE-2024-9839](https://insights.sbomify.com/CVE-2024-9839/): Uix Slideshow <= 1.6.5 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-9838](https://insights.sbomify.com/CVE-2024-9838/): Auto Affiliate Links < 6.4.7 - Admin+ SQL Injection (medium 5.4)
- [CVE-2024-9837](https://insights.sbomify.com/CVE-2024-9837/): AADMY – Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-9836](https://insights.sbomify.com/CVE-2024-9836/): RSS Feed Widget < 3.0.0 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-9835](https://insights.sbomify.com/CVE-2024-9835/): RSS Feed Widget < 3.0.1 - Reflected XSS (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/137/