# Vulnerabilities published in 2024


- [CVE-2024-9188](https://insights.sbomify.com/CVE-2024-9188/): Specially constructed queries cause cross platform scripting leaking administrator tokens (high 8.8)
- [CVE-2024-9187](https://insights.sbomify.com/CVE-2024-9187/): Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion (medium 4.3)
- [CVE-2024-9186](https://insights.sbomify.com/CVE-2024-9186/): Automation By Autonami < 3.3.0 - Unauthenticated SQLi (high 8.6)
- [CVE-2024-9184](https://insights.sbomify.com/CVE-2024-9184/): SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-9183](https://insights.sbomify.com/CVE-2024-9183/): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (high 7.7)
- [CVE-2024-9182](https://insights.sbomify.com/CVE-2024-9182/): Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9180](https://insights.sbomify.com/CVE-2024-9180/): Vault Operators in Root Namespace May Elevate Their Privileges (high 7.2)
- [CVE-2024-9178](https://insights.sbomify.com/CVE-2024-9178/): XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9177](https://insights.sbomify.com/CVE-2024-9177/): Themedy Toolbox <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (medium 6.4)
- [CVE-2024-9174](https://insights.sbomify.com/CVE-2024-9174/): Stored HTML Injection in Hubshare social module (medium 6.9)
- [CVE-2024-9173](https://insights.sbomify.com/CVE-2024-9173/): GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9172](https://insights.sbomify.com/CVE-2024-9172/): Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9170](https://insights.sbomify.com/CVE-2024-9170/): Cross-site scripting in Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools (medium 5.5)
- [CVE-2024-9169](https://insights.sbomify.com/CVE-2024-9169/): litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-9167](https://insights.sbomify.com/CVE-2024-9167/): Privilege escalation in Velocity License Server (high 7.8)
- [CVE-2024-9166](https://insights.sbomify.com/CVE-2024-9166/): OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver (critical 9.3)
- [CVE-2024-9165](https://insights.sbomify.com/CVE-2024-9165/): Cross-site scripting in Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) (medium 6.4)
- [CVE-2024-9164](https://insights.sbomify.com/CVE-2024-9164/): Missing Authentication for Critical Function in GitLab (critical 9.6)
- [CVE-2024-9163](https://insights.sbomify.com/CVE-2024-9163/): User Interface (UI) Misrepresentation of Critical Information in GitLab (low 3.5)
- [CVE-2024-9162](https://insights.sbomify.com/CVE-2024-9162/): All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection (high 7.2)
- [CVE-2024-9161](https://insights.sbomify.com/CVE-2024-9161/): Missing authorization in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (medium 6.5)
- [CVE-2024-9160](https://insights.sbomify.com/CVE-2024-9160/): Security Misconfiguration in Forge module PEADM (medium 5.4)
- [CVE-2024-9159](https://insights.sbomify.com/CVE-2024-9159/): Incorrect Authorization in gaizhenbiao/chuanhuchatgpt (medium 6.5)
- [CVE-2024-9158](https://insights.sbomify.com/CVE-2024-9158/): XSS (high 8.4)
- [CVE-2024-9157](https://insights.sbomify.com/CVE-2024-9157/): Privilege Escalation Vulnerability in CxUIUSvc service (high 7.8)
- [CVE-2024-9156](https://insights.sbomify.com/CVE-2024-9156/): TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parameters (medium 5.9)
- [CVE-2024-9155](https://insights.sbomify.com/CVE-2024-9155/): Insufficient Authorization On Unlinked Channel Files (medium 4.3)
- [CVE-2024-9154](https://insights.sbomify.com/CVE-2024-9154/): Authenticated Remote Code Execution (high 8.6)
- [CVE-2024-9150](https://insights.sbomify.com/CVE-2024-9150/): Code Injection in Wyn Enterprise (high 8.7)
- [CVE-2024-9149](https://insights.sbomify.com/CVE-2024-9149/): SQLi in Wind Media's E-Commerce Website Template (high 8.6)
- [CVE-2024-9148](https://insights.sbomify.com/CVE-2024-9148/): Flowise Stored Cross-Site Scripting (critical 9.6)
- [CVE-2024-9147](https://insights.sbomify.com/CVE-2024-9147/): HTML Injection in Bna Informatics' PosPratik (medium 6.9)
- [CVE-2024-9146](https://insights.sbomify.com/CVE-2024-9146/): WordPress CSS JS Files plugin <= 1.5.0 - Directory Traversal to File Read vulnerability (medium 4.9)
- [CVE-2024-9145](https://insights.sbomify.com/CVE-2024-9145/): Local command injection in Wiz Code Visual Studio Code extension (high 7.1)
- [CVE-2024-9143](https://insights.sbomify.com/CVE-2024-9143/): Low-level invalid GF(2^m) parameters lead to OOB memory access (medium 4.3)
- [CVE-2024-9142](https://insights.sbomify.com/CVE-2024-9142/): Local File Inclusion (LFI) in Olgu Computer Systems' e-Belediye (critical 9.4)
- [CVE-2024-9141](https://insights.sbomify.com/CVE-2024-9141/): Cross-Site Scripting (XSS) vulnerability in Oct8ne (medium 5.4)
- [CVE-2024-9140](https://insights.sbomify.com/CVE-2024-9140/): Command injection in EDF-G1002-BP Series (critical 9.3)
- [CVE-2024-9139](https://insights.sbomify.com/CVE-2024-9139/): OS Command Injection in Restricted Command (high 8.6)
- [CVE-2024-9138](https://insights.sbomify.com/CVE-2024-9138/): Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances (high 8.6)
- [CVE-2024-9137](https://insights.sbomify.com/CVE-2024-9137/): Moxa Service Missing Authentication for Critical Function (high 8.8)
- [CVE-2024-9136](https://insights.sbomify.com/CVE-2024-9136/): Missing authorization in EMUI (medium 6.7)
- [CVE-2024-9135](https://insights.sbomify.com/CVE-2024-9135/): Denial of service in EOS (medium 5.3)
- [CVE-2024-9134](https://insights.sbomify.com/CVE-2024-9134/): SQL injection in Arista Edge Threat Management (high 8.3)
- [CVE-2024-9133](https://insights.sbomify.com/CVE-2024-9133/): A user with administrator privileges is able to retrieve authentication tokens (medium 6.6)
- [CVE-2024-9132](https://insights.sbomify.com/CVE-2024-9132/): The administrator is able to configure an insecure captive portal script (high 8.1)
- [CVE-2024-9131](https://insights.sbomify.com/CVE-2024-9131/): A user with administrator privileges can perform command injection (high 7.2)
- [CVE-2024-9130](https://insights.sbomify.com/CVE-2024-9130/): SQL injection in GiveWP – Donation Plugin and Fundraising Platform (high 7.2)
- [CVE-2024-9129](https://insights.sbomify.com/CVE-2024-9129/): Format String Injection in Zend Server (critical 9.3)
- [CVE-2024-9127](https://insights.sbomify.com/CVE-2024-9127/): Super Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter (medium 6.4)
- [CVE-2024-9126](https://insights.sbomify.com/CVE-2024-9126/): Use after free in Chrome (high 7.5)
- [CVE-2024-9125](https://insights.sbomify.com/CVE-2024-9125/): king_IE <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9124](https://insights.sbomify.com/CVE-2024-9124/): Rockwell Automation PowerFlex 6000T CIP Security denial-of-service Vulnerability (high 8.2)
- [CVE-2024-9123](https://insights.sbomify.com/CVE-2024-9123/): Integer overflow in Chrome (high 8.8)
- [CVE-2024-9122](https://insights.sbomify.com/CVE-2024-9122/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-9121](https://insights.sbomify.com/CVE-2024-9121/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-9120](https://insights.sbomify.com/CVE-2024-9120/): Use after free in Chrome (high 8.8)
- [CVE-2024-9119](https://insights.sbomify.com/CVE-2024-9119/): SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9118](https://insights.sbomify.com/CVE-2024-9118/): QS Dark Mode Plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9117](https://insights.sbomify.com/CVE-2024-9117/): Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9116](https://insights.sbomify.com/CVE-2024-9116/): Monkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9115](https://insights.sbomify.com/CVE-2024-9115/): Common Tools for Site <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9114](https://insights.sbomify.com/CVE-2024-9114/): FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9113](https://insights.sbomify.com/CVE-2024-9113/): FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9112](https://insights.sbomify.com/CVE-2024-9112/): FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9111](https://insights.sbomify.com/CVE-2024-9111/): Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9110](https://insights.sbomify.com/CVE-2024-9110/): Cross-Site Scripting In Privileged Identity (medium 6.4)
- [CVE-2024-9109](https://insights.sbomify.com/CVE-2024-9109/): UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset (medium 4.3)
- [CVE-2024-9108](https://insights.sbomify.com/CVE-2024-9108/): Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-9107](https://insights.sbomify.com/CVE-2024-9107/): Stored XSS in gaizhenbiao/chuanhuchatgpt (medium 6.8)
- [CVE-2024-9106](https://insights.sbomify.com/CVE-2024-9106/): Wechat Social login <= 1.3.0 - Authentication Bypass (critical 9.8)
- [CVE-2024-9105](https://insights.sbomify.com/CVE-2024-9105/): UltimateAI <= 2.8.3 - Authentication Bypass (critical 9.8)
- [CVE-2024-9104](https://insights.sbomify.com/CVE-2024-9104/): UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check (medium 5.6)
- [CVE-2024-9103](https://insights.sbomify.com/CVE-2024-9103/): Persistent XSS in blocked messages (medium 6.1)
- [CVE-2024-9102](https://insights.sbomify.com/CVE-2024-9102/): phpLDAPadmin: Improper Neutralization of Formula Elements (medium 5.0)
- [CVE-2024-9101](https://insights.sbomify.com/CVE-2024-9101/): phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php (low 2.1)
- [CVE-2024-9100](https://insights.sbomify.com/CVE-2024-9100/): Local File Inclusion (medium 6.5)
- [CVE-2024-9099](https://insights.sbomify.com/CVE-2024-9099/): Exposure of Private API Keys in lunary-ai/lunary (high 8.8)
- [CVE-2024-9098](https://insights.sbomify.com/CVE-2024-9098/): Privilege Escalation in lunary-ai/lunary (high 7.3)
- [CVE-2024-9097](https://insights.sbomify.com/CVE-2024-9097/): IDOR (low 3.5)
- [CVE-2024-9096](https://insights.sbomify.com/CVE-2024-9096/): Improper Authorization in lunary-ai/lunary (high 7.6)
- [CVE-2024-9095](https://insights.sbomify.com/CVE-2024-9095/): Improper Authorization in lunary-ai/lunary (critical 9.8)
- [CVE-2024-9094](https://insights.sbomify.com/CVE-2024-9094/): code-projects Blood Bank System o-.php sql injection (medium 5.3)
- [CVE-2024-9093](https://insights.sbomify.com/CVE-2024-9093/): SourceCodester Profile Registration without Reload Refresh GET Parameter del.php sql injection (medium 5.3)
- [CVE-2024-9092](https://insights.sbomify.com/CVE-2024-9092/): SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting (medium 5.3)
- [CVE-2024-9091](https://insights.sbomify.com/CVE-2024-9091/): code-projects Student Record System index.php sql injection (medium 6.9)
- [CVE-2024-9090](https://insights.sbomify.com/CVE-2024-9090/): SourceCodester Modern Loan Management System search_member.php sql injection (medium 5.3)
- [CVE-2024-9089](https://insights.sbomify.com/CVE-2024-9089/): SourceCodester Modern Loan Management System update_loan_record.php cross site scripting (medium 5.3)
- [CVE-2024-9088](https://insights.sbomify.com/CVE-2024-9088/): SourceCodester Telecom Billing Management System login buffer overflow (medium 5.3)
- [CVE-2024-9087](https://insights.sbomify.com/CVE-2024-9087/): code-projects Vehicle Management edit1.php sql injection (medium 6.9)
- [CVE-2024-9086](https://insights.sbomify.com/CVE-2024-9086/): code-projects Restaurant Reservation System filter.php sql injection (medium 5.3)
- [CVE-2024-9085](https://insights.sbomify.com/CVE-2024-9085/): code-projects Restaurant Reservation System index.php sql injection (medium 6.9)
- [CVE-2024-9084](https://insights.sbomify.com/CVE-2024-9084/): code-projects Blood Bank System bbms.php cross site scripting (medium 5.3)
- [CVE-2024-9083](https://insights.sbomify.com/CVE-2024-9083/): SourceCodester Employee Management System add-admin.php cross site scripting (medium 5.1)
- [CVE-2024-9082](https://insights.sbomify.com/CVE-2024-9082/): SourceCodester Online Eyewear Shop User Creation Users.php improper authorization (medium 5.3)
- [CVE-2024-9081](https://insights.sbomify.com/CVE-2024-9081/): SourceCodester Online Eyewear Shop view_category.php sql injection (medium 5.3)
- [CVE-2024-9080](https://insights.sbomify.com/CVE-2024-9080/): code-projects Student Record System pincode-verification.php sql injection (medium 6.9)
- [CVE-2024-9079](https://insights.sbomify.com/CVE-2024-9079/): code-projects Student Record System marks.php sql injection (medium 6.9)
- [CVE-2024-9078](https://insights.sbomify.com/CVE-2024-9078/): code-projects Student Record System course.php sql injection (medium 6.9)
- [CVE-2024-9077](https://insights.sbomify.com/CVE-2024-9077/): dingfangzu Order Checkout order.js cross site scripting (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/144/