# Vulnerabilities published in 2024


- [CVE-2024-8550](https://insights.sbomify.com/CVE-2024-8550/): Local File Inclusion (LFI) in modelscope/agentscope (high 7.5)
- [CVE-2024-8549](https://insights.sbomify.com/CVE-2024-8549/): Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8548](https://insights.sbomify.com/CVE-2024-8548/): Missing authorization in KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin (high 8.1)
- [CVE-2024-8547](https://insights.sbomify.com/CVE-2024-8547/): Simple Popup Plugin <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8546](https://insights.sbomify.com/CVE-2024-8546/): ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget (medium 6.4)
- [CVE-2024-8544](https://insights.sbomify.com/CVE-2024-8544/): Pixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8543](https://insights.sbomify.com/CVE-2024-8543/): Slider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8542](https://insights.sbomify.com/CVE-2024-8542/): Everest Forms < 3.0.3.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8541](https://insights.sbomify.com/CVE-2024-8541/): Cross-site scripting in Discount Rules for WooCommerce (medium 4.7)
- [CVE-2024-8540](https://insights.sbomify.com/CVE-2024-8540/): Misconfiguration in Sentry (high 8.8)
- [CVE-2024-8539](https://insights.sbomify.com/CVE-2024-8539/): Missing authorization in Secure Access Client (high 7.1)
- [CVE-2024-8538](https://insights.sbomify.com/CVE-2024-8538/): Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure (medium 4.3)
- [CVE-2024-8537](https://insights.sbomify.com/CVE-2024-8537/): Path Traversal in modelscope/agentscope (critical 9.1)
- [CVE-2024-8536](https://insights.sbomify.com/CVE-2024-8536/): Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-8535](https://insights.sbomify.com/CVE-2024-8535/): Authenticated user can access unintended user capabilities (medium 5.8)
- [CVE-2024-8534](https://insights.sbomify.com/CVE-2024-8534/): Memory safety vulnerability leading to memory corruption and Denial of Service (high 8.4)
- [CVE-2024-8533](https://insights.sbomify.com/CVE-2024-8533/): Rockwell Automation OptixPanel™ Privilege Escalation Vulnerability via File Permissions (high 7.7)
- [CVE-2024-8531](https://insights.sbomify.com/CVE-2024-8531/): Security feature bypass in Data Center Expert (high 7.2)
- [CVE-2024-8530](https://insights.sbomify.com/CVE-2024-8530/): Missing authorization in Data Center Expert (medium 5.9)
- [CVE-2024-8529](https://insights.sbomify.com/CVE-2024-8529/): LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' (critical 10.0)
- [CVE-2024-8528](https://insights.sbomify.com/CVE-2024-8528/): ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter (medium 5.4)
- [CVE-2024-8527](https://insights.sbomify.com/CVE-2024-8527/): ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter (high 8.6)
- [CVE-2024-8526](https://insights.sbomify.com/CVE-2024-8526/): Automated Logic WebCTRL and Carrier i-Vu Open Redirect (medium 5.9)
- [CVE-2024-8525](https://insights.sbomify.com/CVE-2024-8525/): Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload (critical 10.0)
- [CVE-2024-8524](https://insights.sbomify.com/CVE-2024-8524/): Directory Traversal in modelscope/agentscope (high 7.5)
- [CVE-2024-8523](https://insights.sbomify.com/CVE-2024-8523/): lmxcms SQL Command Execution Module admin.php formatData code injection (medium 5.1)
- [CVE-2024-8522](https://insights.sbomify.com/CVE-2024-8522/): LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' (critical 10.0)
- [CVE-2024-8521](https://insights.sbomify.com/CVE-2024-8521/): Wavelog Live QSO qso index cross site scripting (medium 6.9)
- [CVE-2024-8520](https://insights.sbomify.com/CVE-2024-8520/): Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change (medium 5.3)
- [CVE-2024-8519](https://insights.sbomify.com/CVE-2024-8519/): Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8518](https://insights.sbomify.com/CVE-2024-8518/): Denial of service in Zelio Soft 2 (low 3.3)
- [CVE-2024-8517](https://insights.sbomify.com/CVE-2024-8517/): SPIP Bigup Multipart File Upload OS Command Injection (critical 9.8)
- [CVE-2024-8516](https://insights.sbomify.com/CVE-2024-8516/): Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Information Exposure (medium 4.3)
- [CVE-2024-8515](https://insights.sbomify.com/CVE-2024-8515/): Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8514](https://insights.sbomify.com/CVE-2024-8514/): Prisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object Injection (critical 9.1)
- [CVE-2024-8513](https://insights.sbomify.com/CVE-2024-8513/): QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update (medium 5.3)
- [CVE-2024-8512](https://insights.sbomify.com/CVE-2024-8512/): W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution (critical 9.1)
- [CVE-2024-8510](https://insights.sbomify.com/CVE-2024-8510/): N-central Path Traversal (medium 5.3)
- [CVE-2024-8509](https://insights.sbomify.com/CVE-2024-8509/): Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication (high 7.5)
- [CVE-2024-8508](https://insights.sbomify.com/CVE-2024-8508/): Unbounded name compression could lead to Denial of Service (medium 5.3)
- [CVE-2024-8507](https://insights.sbomify.com/CVE-2024-8507/): File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2024-8505](https://insights.sbomify.com/CVE-2024-8505/): Cross-site scripting in Ajax Load More – Infinite Scroll, Load More, & Lazy Load (medium 6.4)
- [CVE-2024-8504](https://insights.sbomify.com/CVE-2024-8504/): VICIdial Authenticated Remote Code Execution (high 8.8)
- [CVE-2024-8503](https://insights.sbomify.com/CVE-2024-8503/): VICIdial Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-8502](https://insights.sbomify.com/CVE-2024-8502/): Remote Code Execution via Deserialization in modelscope/agentscope (critical 9.8)
- [CVE-2024-8501](https://insights.sbomify.com/CVE-2024-8501/): Arbitrary File Download in modelscope/agentscope (high 7.5)
- [CVE-2024-8500](https://insights.sbomify.com/CVE-2024-8500/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 5.4)
- [CVE-2024-8499](https://insights.sbomify.com/CVE-2024-8499/): Cross-site scripting in Checkout Field Editor (Checkout Manager) for WooCommerce (medium 4.7)
- [CVE-2024-8497](https://insights.sbomify.com/CVE-2024-8497/): Franklin Fueling Systems TS-550 EVO Absolute Path Traversal (high 8.7)
- [CVE-2024-8496](https://insights.sbomify.com/CVE-2024-8496/): Privilege escalation in Workspace Control (high 7.8)
- [CVE-2024-8495](https://insights.sbomify.com/CVE-2024-8495/): Null dereference in Connect Secure (high 7.5)
- [CVE-2024-8494](https://insights.sbomify.com/CVE-2024-8494/): Information disclosure in Elementor Website Builder Pro (medium 4.3)
- [CVE-2024-8493](https://insights.sbomify.com/CVE-2024-8493/): The Events Calendar < 6.6.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8492](https://insights.sbomify.com/CVE-2024-8492/): Hustle < 7.8.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8490](https://insights.sbomify.com/CVE-2024-8490/): PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details (high 8.8)
- [CVE-2024-8489](https://insights.sbomify.com/CVE-2024-8489/): CSRF due to overly permissive CORS headers in modelscope/agentscope (high 8.8)
- [CVE-2024-8488](https://insights.sbomify.com/CVE-2024-8488/): Cross-site scripting in Survey Maker (medium 4.4)
- [CVE-2024-8487](https://insights.sbomify.com/CVE-2024-8487/): CORS Vulnerability in modelscope/agentscope (high 7.4)
- [CVE-2024-8486](https://insights.sbomify.com/CVE-2024-8486/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-8485](https://insights.sbomify.com/CVE-2024-8485/): Missing authorization in REST API TO MiniProgram (critical 9.8)
- [CVE-2024-8484](https://insights.sbomify.com/CVE-2024-8484/): REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-8483](https://insights.sbomify.com/CVE-2024-8483/): MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure (medium 4.3)
- [CVE-2024-8482](https://insights.sbomify.com/CVE-2024-8482/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-8481](https://insights.sbomify.com/CVE-2024-8481/): Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-8480](https://insights.sbomify.com/CVE-2024-8480/): File upload in Image Optimizer, Resizer and CDN – Sirv (high 8.8)
- [CVE-2024-8479](https://insights.sbomify.com/CVE-2024-8479/): Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-8478](https://insights.sbomify.com/CVE-2024-8478/): Affiliate Super Assistent <= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-8477](https://insights.sbomify.com/CVE-2024-8477/): Cross-site request forgery in Brevo – Email, SMS, Web Push, Chat, and more. (medium 4.3)
- [CVE-2024-8476](https://insights.sbomify.com/CVE-2024-8476/): Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion (medium 4.3)
- [CVE-2024-8475](https://insights.sbomify.com/CVE-2024-8475/): Protection Mechanism Failure in Digital Operation Services' WiFiBurada (medium 6.5)
- [CVE-2024-8474](https://insights.sbomify.com/CVE-2024-8474/): Information disclosure in OpenVPN Connect (high 7.5)
- [CVE-2024-8473](https://insights.sbomify.com/CVE-2024-8473/): SQL injection vulnerability in Job Portal (medium 6.3)
- [CVE-2024-8472](https://insights.sbomify.com/CVE-2024-8472/): SQL injection vulnerability in Job Portal (medium 6.3)
- [CVE-2024-8471](https://insights.sbomify.com/CVE-2024-8471/): SQL injection vulnerability in Job Portal (medium 6.3)
- [CVE-2024-8470](https://insights.sbomify.com/CVE-2024-8470/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8469](https://insights.sbomify.com/CVE-2024-8469/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8468](https://insights.sbomify.com/CVE-2024-8468/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8467](https://insights.sbomify.com/CVE-2024-8467/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8466](https://insights.sbomify.com/CVE-2024-8466/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8465](https://insights.sbomify.com/CVE-2024-8465/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8464](https://insights.sbomify.com/CVE-2024-8464/): SQL injection vulnerability in Job Portal (critical 9.8)
- [CVE-2024-8463](https://insights.sbomify.com/CVE-2024-8463/): File upload restriction bypass vulnerability in Job Portal (critical 9.9)
- [CVE-2024-8462](https://insights.sbomify.com/CVE-2024-8462/): Windmill HTTP Request users.rs excessive authentication (medium 6.3)
- [CVE-2024-8461](https://insights.sbomify.com/CVE-2024-8461/): D-Link DNS-320 Web Management Interface discovery.cgi information disclosure (medium 6.9)
- [CVE-2024-8460](https://insights.sbomify.com/CVE-2024-8460/): D-Link DNS-320 Web Management Interface widget_api.cgi information disclosure (medium 6.3)
- [CVE-2024-8459](https://insights.sbomify.com/CVE-2024-8459/): PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords (high 7.2)
- [CVE-2024-8458](https://insights.sbomify.com/CVE-2024-8458/): PLANET Technology switch devices - Cross-site Request Forgery (high 8.8)
- [CVE-2024-8457](https://insights.sbomify.com/CVE-2024-8457/): PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management (medium 4.8)
- [CVE-2024-8456](https://insights.sbomify.com/CVE-2024-8456/): PLANET Technology switch devices - Missing Authentication for multiple HTTP routes (critical 9.8)
- [CVE-2024-8455](https://insights.sbomify.com/CVE-2024-8455/): PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords (high 8.1)
- [CVE-2024-8454](https://insights.sbomify.com/CVE-2024-8454/): PLANET Technology switch devices - Swctrl service DoS attack (medium 5.3)
- [CVE-2024-8453](https://insights.sbomify.com/CVE-2024-8453/): PLANET Technology switch devices - Weak hash for users' passwords (medium 4.9)
- [CVE-2024-8452](https://insights.sbomify.com/CVE-2024-8452/): PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials (high 7.5)
- [CVE-2024-8451](https://insights.sbomify.com/CVE-2024-8451/): PLANET Technology switch devices - SSH server DoS attack (high 7.5)
- [CVE-2024-8450](https://insights.sbomify.com/CVE-2024-8450/): PLANET Technology switch devices - Hard-coded SNMPv1 read-write community string (high 8.6)
- [CVE-2024-8449](https://insights.sbomify.com/CVE-2024-8449/): PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials (medium 6.8)
- [CVE-2024-8448](https://insights.sbomify.com/CVE-2024-8448/): PLANET Technology switch devices - Remote privilege escalation using hard-coded credentials (high 8.8)
- [CVE-2024-8447](https://insights.sbomify.com/CVE-2024-8447/): Narayana: deadlock via multiple join requests sent to lra coordinator (medium 5.9)
- [CVE-2024-8445](https://insights.sbomify.com/CVE-2024-8445/): 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199) (medium 5.7)
- [CVE-2024-8444](https://insights.sbomify.com/CVE-2024-8444/): Download Manager < 3.3.00 - Contributor+ Stored XSS (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/150/