# Vulnerabilities published in 2024


- [CVE-2024-8760](https://insights.sbomify.com/CVE-2024-8760/): Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection (medium 5.3)
- [CVE-2024-8759](https://insights.sbomify.com/CVE-2024-8759/): Nested Pages <= 3.2.8 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-8758](https://insights.sbomify.com/CVE-2024-8758/): Quiz and Survey Master (QSM) < 9.1.3 - Author+ Stored XSS (medium 4.8)
- [CVE-2024-8757](https://insights.sbomify.com/CVE-2024-8757/): Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection (high 7.2)
- [CVE-2024-8756](https://insights.sbomify.com/CVE-2024-8756/): Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-8755](https://insights.sbomify.com/CVE-2024-8755/): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (high 8.4)
- [CVE-2024-8754](https://insights.sbomify.com/CVE-2024-8754/): External Control of Critical State Data in GitLab (medium 6.4)
- [CVE-2024-8752](https://insights.sbomify.com/CVE-2024-8752/): WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability (critical 9.3)
- [CVE-2024-8751](https://insights.sbomify.com/CVE-2024-8751/): CVE-2024-8751 (high 7.5)
- [CVE-2024-8750](https://insights.sbomify.com/CVE-2024-8750/): Cross-site Scripting vulnerability in Idoit pro (medium 5.4)
- [CVE-2024-8749](https://insights.sbomify.com/CVE-2024-8749/): SQL Injection vulnerability in Idoit pro (high 8.8)
- [CVE-2024-8748](https://insights.sbomify.com/CVE-2024-8748/): Memory corruption in VMG8825-T50K firmware (high 7.5)
- [CVE-2024-8747](https://insights.sbomify.com/CVE-2024-8747/): Email Obfuscate Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8746](https://insights.sbomify.com/CVE-2024-8746/): File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload (high 7.5)
- [CVE-2024-8743](https://insights.sbomify.com/CVE-2024-8743/): File upload in File Manager (medium 6.8)
- [CVE-2024-8742](https://insights.sbomify.com/CVE-2024-8742/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-8741](https://insights.sbomify.com/CVE-2024-8741/): Beam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8740](https://insights.sbomify.com/CVE-2024-8740/): GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8739](https://insights.sbomify.com/CVE-2024-8739/): ReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8738](https://insights.sbomify.com/CVE-2024-8738/): Seriously Simple Stats <= 1.6.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8737](https://insights.sbomify.com/CVE-2024-8737/): PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8736](https://insights.sbomify.com/CVE-2024-8736/): Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui (high 7.1)
- [CVE-2024-8735](https://insights.sbomify.com/CVE-2024-8735/): MailMunch – Grow your Email List <= 3.1.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8734](https://insights.sbomify.com/CVE-2024-8734/): Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8733](https://insights.sbomify.com/CVE-2024-8733/): HP One Agent Software – Potential Privilege Escalation (high 8.0)
- [CVE-2024-8732](https://insights.sbomify.com/CVE-2024-8732/): Roles & Capabilities <= 1.1.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8731](https://insights.sbomify.com/CVE-2024-8731/): Cron Jobs <= 1.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8730](https://insights.sbomify.com/CVE-2024-8730/): Exit Notifier <= 1.10.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8729](https://insights.sbomify.com/CVE-2024-8729/): Easy Social Share Buttons <= 1.4.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8728](https://insights.sbomify.com/CVE-2024-8728/): Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8727](https://insights.sbomify.com/CVE-2024-8727/): DK PDF <= 1.9.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8726](https://insights.sbomify.com/CVE-2024-8726/): MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8725](https://insights.sbomify.com/CVE-2024-8725/): Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload (medium 6.8)
- [CVE-2024-8724](https://insights.sbomify.com/CVE-2024-8724/): Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8723](https://insights.sbomify.com/CVE-2024-8723/): 012 PS Multi Languages <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8722](https://insights.sbomify.com/CVE-2024-8722/): WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (medium 5.5)
- [CVE-2024-8721](https://insights.sbomify.com/CVE-2024-8721/): Tracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8720](https://insights.sbomify.com/CVE-2024-8720/): RumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8719](https://insights.sbomify.com/CVE-2024-8719/): Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8718](https://insights.sbomify.com/CVE-2024-8718/): Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8717](https://insights.sbomify.com/CVE-2024-8717/): PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip <= 2.3.32 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8716](https://insights.sbomify.com/CVE-2024-8716/): XT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8715](https://insights.sbomify.com/CVE-2024-8715/): Simple LDAP Login <= 1.6.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8714](https://insights.sbomify.com/CVE-2024-8714/): WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8713](https://insights.sbomify.com/CVE-2024-8713/): Kodex Posts likes <= 2.5.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8712](https://insights.sbomify.com/CVE-2024-8712/): GTM Server Side <= 2.1.19 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8711](https://insights.sbomify.com/CVE-2024-8711/): SourceCodester Food Ordering Management System includes exposure of information through directory listing (medium 6.9)
- [CVE-2024-8710](https://insights.sbomify.com/CVE-2024-8710/): code-projects Inventory Management Products Table Page viewProduct.php sql injection (medium 5.3)
- [CVE-2024-8709](https://insights.sbomify.com/CVE-2024-8709/): SourceCodester Best House Rental Management System admin_class.php save_user sql injection (medium 5.3)
- [CVE-2024-8708](https://insights.sbomify.com/CVE-2024-8708/): SourceCodester Best House Rental Management System categories.php cross site scripting (medium 5.3)
- [CVE-2024-8707](https://insights.sbomify.com/CVE-2024-8707/): 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal (medium 5.3)
- [CVE-2024-8706](https://insights.sbomify.com/CVE-2024-8706/): JFinalCMS com.cms.util.TemplateUtils update path traversal (medium 5.3)
- [CVE-2024-8705](https://insights.sbomify.com/CVE-2024-8705/): SQL injection in Heating Network Wireless Monitoring System (medium 5.3)
- [CVE-2024-8704](https://insights.sbomify.com/CVE-2024-8704/): Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale (high 7.2)
- [CVE-2024-8703](https://insights.sbomify.com/CVE-2024-8703/): Z-Downloads < 1.11.6 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-8702](https://insights.sbomify.com/CVE-2024-8702/): Backup Database <= 4.9 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8701](https://insights.sbomify.com/CVE-2024-8701/): Event Calendar <= 1.0.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8700](https://insights.sbomify.com/CVE-2024-8700/): Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion (high 7.5)
- [CVE-2024-8699](https://insights.sbomify.com/CVE-2024-8699/): Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2024-8698](https://insights.sbomify.com/CVE-2024-8698/): Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak (high 7.7)
- [CVE-2024-8696](https://insights.sbomify.com/CVE-2024-8696/): Code injection in Docker Desktop (high 8.9)
- [CVE-2024-8695](https://insights.sbomify.com/CVE-2024-8695/): Code injection in Docker Desktop (critical 9.0)
- [CVE-2024-8694](https://insights.sbomify.com/CVE-2024-8694/): JFinalCMS com.cms.controller.admin.TemplateController update path traversal (medium 5.1)
- [CVE-2024-8693](https://insights.sbomify.com/CVE-2024-8693/): Kaon CG3000 dhcpcd Command cross site scripting (medium 5.1)
- [CVE-2024-8692](https://insights.sbomify.com/CVE-2024-8692/): TDuckCloud TDuckPro password recovery (medium 6.9)
- [CVE-2024-8691](https://insights.sbomify.com/CVE-2024-8691/): PAN-OS: User Impersonation in GlobalProtect Portal (medium 5.3)
- [CVE-2024-8690](https://insights.sbomify.com/CVE-2024-8690/): Cortex XDR Agent: Local Windows Administrator Can Disable the Agent (medium 5.6)
- [CVE-2024-8689](https://insights.sbomify.com/CVE-2024-8689/): ActiveMQ Content Pack: Cleartext Exposure of Credentials (medium 6.0)
- [CVE-2024-8688](https://insights.sbomify.com/CVE-2024-8688/): PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI) (medium 6.7)
- [CVE-2024-8687](https://insights.sbomify.com/CVE-2024-8687/): PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes (medium 6.9)
- [CVE-2024-8686](https://insights.sbomify.com/CVE-2024-8686/): PAN-OS: Command Injection Vulnerability (high 8.6)
- [CVE-2024-8685](https://insights.sbomify.com/CVE-2024-8685/): Path-Traversal vulnerability in Revolution Pi (medium 4.3)
- [CVE-2024-8684](https://insights.sbomify.com/CVE-2024-8684/): OS Command Injection vulnerability in Revolution Pi (high 8.3)
- [CVE-2024-8682](https://insights.sbomify.com/CVE-2024-8682/): JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration (medium 5.3)
- [CVE-2024-8681](https://insights.sbomify.com/CVE-2024-8681/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-8680](https://insights.sbomify.com/CVE-2024-8680/): MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-8679](https://insights.sbomify.com/CVE-2024-8679/): Library Management System <= 3.1 - Authenticated (Admin+) SQL Injection (medium 6.8)
- [CVE-2024-8678](https://insights.sbomify.com/CVE-2024-8678/): Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update (medium 5.3)
- [CVE-2024-8676](https://insights.sbomify.com/CVE-2024-8676/): Cri-o: checkpoint restore can be triggered from different namespaces (high 7.4)
- [CVE-2024-8675](https://insights.sbomify.com/CVE-2024-8675/): Soumettre.fr <= 2.1.3 - Missing Authorization (medium 4.3)
- [CVE-2024-8673](https://insights.sbomify.com/CVE-2024-8673/): Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload (critical 9.1)
- [CVE-2024-8672](https://insights.sbomify.com/CVE-2024-8672/): Code injection in Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets (critical 9.9)
- [CVE-2024-8671](https://insights.sbomify.com/CVE-2024-8671/): WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite (critical 9.1)
- [CVE-2024-8670](https://insights.sbomify.com/CVE-2024-8670/): Photo Gallery by 10Web < 1.8.29 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8669](https://insights.sbomify.com/CVE-2024-8669/): Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection (critical 9.1)
- [CVE-2024-8668](https://insights.sbomify.com/CVE-2024-8668/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 6.4)
- [CVE-2024-8667](https://insights.sbomify.com/CVE-2024-8667/): Missing authorization in HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce (medium 4.3)
- [CVE-2024-8666](https://insights.sbomify.com/CVE-2024-8666/): Shoutcast Icecast HTML5 Radio Player <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8665](https://insights.sbomify.com/CVE-2024-8665/): YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8664](https://insights.sbomify.com/CVE-2024-8664/): WP Test Email <= 1.1.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8663](https://insights.sbomify.com/CVE-2024-8663/): WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8662](https://insights.sbomify.com/CVE-2024-8662/): Koko Analytics <= 1.3.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8661](https://insights.sbomify.com/CVE-2024-8661/): Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block (medium 4.6)
- [CVE-2024-8660](https://insights.sbomify.com/CVE-2024-8660/): Stored XSS in the "Top Navigator Bar" block (medium 4.6)
- [CVE-2024-8658](https://insights.sbomify.com/CVE-2024-8658/): Missing authorization in Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (medium 5.3)
- [CVE-2024-8657](https://insights.sbomify.com/CVE-2024-8657/): Garden Gnome Package <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8656](https://insights.sbomify.com/CVE-2024-8656/): WPFactory Helper <= 1.7.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8655](https://insights.sbomify.com/CVE-2024-8655/): Mercury MNVR816 web-static file access (medium 6.9)
- [CVE-2024-8654](https://insights.sbomify.com/CVE-2024-8654/): MongoDB Server may access non-initialized region of memory leading to unexpected behaviour (medium 5.0)
- [CVE-2024-8653](https://insights.sbomify.com/CVE-2024-8653/): Netcat CMS: multiple reflected cross-site scripting vulnerabilities in netshop module (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/148/