# Vulnerabilities published in 2024


- [CVE-2024-9293](https://insights.sbomify.com/CVE-2024-9293/): skyselang yylAdmin Backend File.php list sql injection (medium 5.3)
- [CVE-2024-9292](https://insights.sbomify.com/CVE-2024-9292/): Bridge Core <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9291](https://insights.sbomify.com/CVE-2024-9291/): kalvinGit kvf-admin XML File cross site scripting (medium 5.3)
- [CVE-2024-9290](https://insights.sbomify.com/CVE-2024-9290/): Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-9289](https://insights.sbomify.com/CVE-2024-9289/): WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation (critical 9.8)
- [CVE-2024-9287](https://insights.sbomify.com/CVE-2024-9287/): Virtual environment (venv) activation scripts don't quote paths (medium 5.3)
- [CVE-2024-9286](https://insights.sbomify.com/CVE-2024-9286/): SQLi in TRtek Software's Distant Education Platform (high 8.8)
- [CVE-2024-9285](https://insights.sbomify.com/CVE-2024-9285/): Tu Yafeng Via Browser Javascript Bridge cross site scripting (medium 5.3)
- [CVE-2024-9284](https://insights.sbomify.com/CVE-2024-9284/): TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow (high 7.1)
- [CVE-2024-9283](https://insights.sbomify.com/CVE-2024-9283/): RelaxedJS ReLaXed Pug to PDF Converter cross site scripting (medium 4.8)
- [CVE-2024-9282](https://insights.sbomify.com/CVE-2024-9282/): bg5sbk MiniCMS page-edit.php cross-site request forgery (medium 6.9)
- [CVE-2024-9281](https://insights.sbomify.com/CVE-2024-9281/): bg5sbk MiniCMS post-edit.php cross-site request forgery (medium 6.9)
- [CVE-2024-9280](https://insights.sbomify.com/CVE-2024-9280/): kalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted upload (medium 5.1)
- [CVE-2024-9279](https://insights.sbomify.com/CVE-2024-9279/): funnyzpc Mee-Admin User Center index cross site scripting (medium 5.1)
- [CVE-2024-9278](https://insights.sbomify.com/CVE-2024-9278/): HuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted upload (medium 5.1)
- [CVE-2024-9277](https://insights.sbomify.com/CVE-2024-9277/): Langflow HTTP POST Request utils.py redos (medium 5.1)
- [CVE-2024-9276](https://insights.sbomify.com/CVE-2024-9276/): TMsoft MyAuth Gateway index.php cross site scripting (medium 5.3)
- [CVE-2024-9275](https://insights.sbomify.com/CVE-2024-9275/): jeanmarc77 123solar admin_invt2.php file inclusion (medium 5.3)
- [CVE-2024-9274](https://insights.sbomify.com/CVE-2024-9274/): Elastik Page Builder <= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9272](https://insights.sbomify.com/CVE-2024-9272/): R Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9271](https://insights.sbomify.com/CVE-2024-9271/): Re:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9270](https://insights.sbomify.com/CVE-2024-9270/): Lenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9269](https://insights.sbomify.com/CVE-2024-9269/): Relogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9267](https://insights.sbomify.com/CVE-2024-9267/): Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-9266](https://insights.sbomify.com/CVE-2024-9266/): Open Redirect (medium 4.7)
- [CVE-2024-9265](https://insights.sbomify.com/CVE-2024-9265/): Echo RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-9264](https://insights.sbomify.com/CVE-2024-9264/): Grafana SQL Expressions allow for remote code execution (critical 9.4)
- [CVE-2024-9263](https://insights.sbomify.com/CVE-2024-9263/): Missing authorization in Timetics – Appointment Booking & Scheduling (critical 9.8)
- [CVE-2024-9262](https://insights.sbomify.com/CVE-2024-9262/): Missing authorization in User Meta – User Profile Builder and User management plugin (medium 6.5)
- [CVE-2024-9261](https://insights.sbomify.com/CVE-2024-9261/): IrfanView SID File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9260](https://insights.sbomify.com/CVE-2024-9260/): IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9259](https://insights.sbomify.com/CVE-2024-9259/): IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9258](https://insights.sbomify.com/CVE-2024-9258/): IrfanView SID File Parsing Uninitialized Pointer Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9257](https://insights.sbomify.com/CVE-2024-9257/): Logsign Unified SecOps Platform delete_gsuite_key_file Input Validation Arbitrary File Deletion Vulnerability (medium 4.3)
- [CVE-2024-9256](https://insights.sbomify.com/CVE-2024-9256/): Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9255](https://insights.sbomify.com/CVE-2024-9255/): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9254](https://insights.sbomify.com/CVE-2024-9254/): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9253](https://insights.sbomify.com/CVE-2024-9253/): Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9252](https://insights.sbomify.com/CVE-2024-9252/): Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9251](https://insights.sbomify.com/CVE-2024-9251/): Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9250](https://insights.sbomify.com/CVE-2024-9250/): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9249](https://insights.sbomify.com/CVE-2024-9249/): Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9248](https://insights.sbomify.com/CVE-2024-9248/): Foxit PDF Reader PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9247](https://insights.sbomify.com/CVE-2024-9247/): Foxit PDF Reader Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9246](https://insights.sbomify.com/CVE-2024-9246/): Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9245](https://insights.sbomify.com/CVE-2024-9245/): Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-9244](https://insights.sbomify.com/CVE-2024-9244/): Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-9243](https://insights.sbomify.com/CVE-2024-9243/): Foxit PDF Reader AcroForm Doc Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9242](https://insights.sbomify.com/CVE-2024-9242/): Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-9241](https://insights.sbomify.com/CVE-2024-9241/): PDF Image Generator <= 1.5.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9240](https://insights.sbomify.com/CVE-2024-9240/): ReDi Restaurant Reservation <= 24.0902 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9239](https://insights.sbomify.com/CVE-2024-9239/): Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9238](https://insights.sbomify.com/CVE-2024-9238/): AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod (medium 5.4)
- [CVE-2024-9237](https://insights.sbomify.com/CVE-2024-9237/): Fish and Ships <= 1.5.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9236](https://insights.sbomify.com/CVE-2024-9236/): Team Members Showcase < 4.4.2 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-9235](https://insights.sbomify.com/CVE-2024-9235/): Mapster WP Maps <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update (high 8.8)
- [CVE-2024-9234](https://insights.sbomify.com/CVE-2024-9234/): GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-9233](https://insights.sbomify.com/CVE-2024-9233/): GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-9232](https://insights.sbomify.com/CVE-2024-9232/): Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9231](https://insights.sbomify.com/CVE-2024-9231/): WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9230](https://insights.sbomify.com/CVE-2024-9230/): PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL (medium 5.9)
- [CVE-2024-9229](https://insights.sbomify.com/CVE-2024-9229/): Denial of Service (DoS) via Multipart Boundary in stangirard/quivr (high 7.5)
- [CVE-2024-9228](https://insights.sbomify.com/CVE-2024-9228/): Loggedin – Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9227](https://insights.sbomify.com/CVE-2024-9227/): PowerPress Podcasting < 11.9.18 - Author+ XSS (medium 4.8)
- [CVE-2024-9226](https://insights.sbomify.com/CVE-2024-9226/): Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9225](https://insights.sbomify.com/CVE-2024-9225/): SEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9224](https://insights.sbomify.com/CVE-2024-9224/): Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read (medium 6.5)
- [CVE-2024-9223](https://insights.sbomify.com/CVE-2024-9223/): WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (medium 4.3)
- [CVE-2024-9222](https://insights.sbomify.com/CVE-2024-9222/): Cross-site scripting in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (medium 6.1)
- [CVE-2024-9221](https://insights.sbomify.com/CVE-2024-9221/): Tainacan <= 0.21.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9220](https://insights.sbomify.com/CVE-2024-9220/): LH Copy Media File <= 1.08 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9219](https://insights.sbomify.com/CVE-2024-9219/): WordPress Social Share Buttons <= 1.19 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9218](https://insights.sbomify.com/CVE-2024-9218/): Cross-site scripting in Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid (medium 6.1)
- [CVE-2024-9217](https://insights.sbomify.com/CVE-2024-9217/): Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9216](https://insights.sbomify.com/CVE-2024-9216/): Authentication Bypass in gaizhenbiao/ChuanhuChatGPT (high 8.1)
- [CVE-2024-9215](https://insights.sbomify.com/CVE-2024-9215/): Missing authorization in Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors (high 8.8)
- [CVE-2024-9214](https://insights.sbomify.com/CVE-2024-9214/): Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-9213](https://insights.sbomify.com/CVE-2024-9213/): Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9212](https://insights.sbomify.com/CVE-2024-9212/): SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9211](https://insights.sbomify.com/CVE-2024-9211/): FULL – Cliente <= 3.1.22 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9210](https://insights.sbomify.com/CVE-2024-9210/): MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9209](https://insights.sbomify.com/CVE-2024-9209/): WP Search Analytics <= 1.4.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9208](https://insights.sbomify.com/CVE-2024-9208/): Enable Accessibility <= 1.4.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9207](https://insights.sbomify.com/CVE-2024-9207/): BuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9206](https://insights.sbomify.com/CVE-2024-9206/): MAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9205](https://insights.sbomify.com/CVE-2024-9205/): Maximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9204](https://insights.sbomify.com/CVE-2024-9204/): Smart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9203](https://insights.sbomify.com/CVE-2024-9203/): Enpass Password Manager sensitive information in memory (low 2.0)
- [CVE-2024-9202](https://insights.sbomify.com/CVE-2024-9202/): EDC DataSetResolver policy filtering missing (medium 5.3)
- [CVE-2024-9201](https://insights.sbomify.com/CVE-2024-9201/): SQL injection vulnerability in SEUR plugin (critical 9.4)
- [CVE-2024-9200](https://insights.sbomify.com/CVE-2024-9200/): Command injection in VMG4005-B50A firmware (high 7.2)
- [CVE-2024-9199](https://insights.sbomify.com/CVE-2024-9199/): Rate limit vulnerability in Clibo Manager (medium 5.8)
- [CVE-2024-9198](https://insights.sbomify.com/CVE-2024-9198/): Stored Cross-Site Scripting vulnerability in Clibo Manager (high 7.6)
- [CVE-2024-9197](https://insights.sbomify.com/CVE-2024-9197/): Memory corruption in VMG3625-T50B firmware (medium 4.9)
- [CVE-2024-9195](https://insights.sbomify.com/CVE-2024-9195/): WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-9194](https://insights.sbomify.com/CVE-2024-9194/): SQL Injection in the Octopus Server REST API (high 8.7)
- [CVE-2024-9193](https://insights.sbomify.com/CVE-2024-9193/): WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update (critical 9.8)
- [CVE-2024-9192](https://insights.sbomify.com/CVE-2024-9192/): WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update (high 8.8)
- [CVE-2024-9191](https://insights.sbomify.com/CVE-2024-9191/): Information disclosure in Okta Verify for Windows (high 7.1)
- [CVE-2024-9189](https://insights.sbomify.com/CVE-2024-9189/): EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/143/