# Vulnerabilities published in 2024


- [CVE-2024-7905](https://insights.sbomify.com/CVE-2024-7905/): DedeBIZ archives_do.php AdminUpload unrestricted upload (medium 5.3)
- [CVE-2024-7904](https://insights.sbomify.com/CVE-2024-7904/): DedeBIZ File Extension file_manage_control.php unrestricted upload (medium 5.3)
- [CVE-2024-7903](https://insights.sbomify.com/CVE-2024-7903/): DedeBIZ File Extension media_add.php unrestricted upload (medium 5.3)
- [CVE-2024-7902](https://insights.sbomify.com/CVE-2024-7902/): pkp ojs signOut redirect (medium 6.9)
- [CVE-2024-7901](https://insights.sbomify.com/CVE-2024-7901/): Scada-LTS Message Scada cross site scripting (medium 5.3)
- [CVE-2024-7900](https://insights.sbomify.com/CVE-2024-7900/): xiaohe4966 TpMeCMS Basic Configuration config cross site scripting (medium 5.1)
- [CVE-2024-7899](https://insights.sbomify.com/CVE-2024-7899/): InnoCMS Backend edit code injection (medium 5.1)
- [CVE-2024-7898](https://insights.sbomify.com/CVE-2024-7898/): Tosei Online Store Management System ネット店舗管理システム Backend default credentials (medium 6.9)
- [CVE-2024-7897](https://insights.sbomify.com/CVE-2024-7897/): Tosei Online Store Management System ネット店舗管理システム tosei_kikai.php command injection (medium 5.3)
- [CVE-2024-7896](https://insights.sbomify.com/CVE-2024-7896/): Tosei Online Store Management System ネット店舗管理システム p1_ftpserver.php command injection (medium 5.3)
- [CVE-2024-7895](https://insights.sbomify.com/CVE-2024-7895/): Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (medium 6.4)
- [CVE-2024-7894](https://insights.sbomify.com/CVE-2024-7894/): If Menu <= 0.19.1 - Missing Authorization to License Key Update (medium 5.3)
- [CVE-2024-7892](https://insights.sbomify.com/CVE-2024-7892/): adstxt Plugin <= 1.0.0 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-7891](https://insights.sbomify.com/CVE-2024-7891/): Floating Contact Button < 2.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7890](https://insights.sbomify.com/CVE-2024-7890/): Local privilege escalation allows a low-privileged user to gain SYSTEM privileges (medium 5.4)
- [CVE-2024-7889](https://insights.sbomify.com/CVE-2024-7889/): Local privilege escalation allows a low-privileged user to gain SYSTEM privileges (high 7.0)
- [CVE-2024-7888](https://insights.sbomify.com/CVE-2024-7888/): Classified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing Authorization (medium 6.3)
- [CVE-2024-7887](https://insights.sbomify.com/CVE-2024-7887/): LimeSurvey File Upload index.php denial of service (medium 5.1)
- [CVE-2024-7886](https://insights.sbomify.com/CVE-2024-7886/): Scooter Software Beyond Compare 7zxa.dll uncontrolled search path (high 8.5)
- [CVE-2024-7885](https://insights.sbomify.com/CVE-2024-7885/): Undertow: improper state management in proxy protocol parsing causes information leakage (high 7.5)
- [CVE-2024-7884](https://insights.sbomify.com/CVE-2024-7884/): Memory leak when calling a canister method via `ic_cdk::call` (high 7.5)
- [CVE-2024-7883](https://insights.sbomify.com/CVE-2024-7883/): CMSE secure state may leak from stack to floating-point registers (low 3.7)
- [CVE-2024-7882](https://insights.sbomify.com/CVE-2024-7882/): SQLi in Special Minds' e-Commerce (medium 6.5)
- [CVE-2024-7881](https://insights.sbomify.com/CVE-2024-7881/): Information disclosure in C1-Premium (medium 5.1)
- [CVE-2024-7879](https://insights.sbomify.com/CVE-2024-7879/): WP ULike < 4.7.5 - Admin+ Stored XSS via Widgets (medium 4.8)
- [CVE-2024-7878](https://insights.sbomify.com/CVE-2024-7878/): WP ULike < 4.7.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7877](https://insights.sbomify.com/CVE-2024-7877/): Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7876](https://insights.sbomify.com/CVE-2024-7876/): Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7875](https://insights.sbomify.com/CVE-2024-7875/): XSS in Tungsten Automation TotalAgility (medium 5.3)
- [CVE-2024-7874](https://insights.sbomify.com/CVE-2024-7874/): XSS in Tungsten Automation TotalAgility (medium 5.3)
- [CVE-2024-7873](https://insights.sbomify.com/CVE-2024-7873/): Stored XSS in Veribilim Software's Veribase Order Management (critical 9.4)
- [CVE-2024-7872](https://insights.sbomify.com/CVE-2024-7872/): Sensetive Data Exposure in ExtremePACS' Extreme XDS (high 7.6)
- [CVE-2024-7871](https://insights.sbomify.com/CVE-2024-7871/): Huachu Easytest Online Learning Test Platform - SQL Injection (high 8.7)
- [CVE-2024-7870](https://insights.sbomify.com/CVE-2024-7870/): Information disclosure in PixelYourSite Pro – Your smart PIXEL (TAG) Manager (medium 6.5)
- [CVE-2024-7869](https://insights.sbomify.com/CVE-2024-7869/): 123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-7868](https://insights.sbomify.com/CVE-2024-7868/): Uninitialized variable in Xpdf 4.05 due to invalid JPEG header (low 2.1)
- [CVE-2024-7867](https://insights.sbomify.com/CVE-2024-7867/): Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinates (low 2.1)
- [CVE-2024-7866](https://insights.sbomify.com/CVE-2024-7866/): Stack overflow in Xpdf 4.05 due to object loop in PDF pattern (low 2.1)
- [CVE-2024-7864](https://insights.sbomify.com/CVE-2024-7864/): Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF (medium 6.5)
- [CVE-2024-7863](https://insights.sbomify.com/CVE-2024-7863/): Favicon Generator < 2.1 - Arbitrary File Upload via CSRF (high 8.1)
- [CVE-2024-7862](https://insights.sbomify.com/CVE-2024-7862/): Blog Introduction <= 0.3.0 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-7861](https://insights.sbomify.com/CVE-2024-7861/): Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-7860](https://insights.sbomify.com/CVE-2024-7860/): Simple Headline Rotator <= 1.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-7859](https://insights.sbomify.com/CVE-2024-7859/): Visual Sound <= 1.03 - Settings Update via CSRF (medium 6.5)
- [CVE-2024-7858](https://insights.sbomify.com/CVE-2024-7858/): Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions (medium 6.3)
- [CVE-2024-7857](https://insights.sbomify.com/CVE-2024-7857/): Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection (medium 6.5)
- [CVE-2024-7856](https://insights.sbomify.com/CVE-2024-7856/): Missing authorization in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar (high 8.1)
- [CVE-2024-7855](https://insights.sbomify.com/CVE-2024-7855/): WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-7854](https://insights.sbomify.com/CVE-2024-7854/): Woo Inquiry <= 0.1 - Unauthenticated SQL Injection (critical 10.0)
- [CVE-2024-7853](https://insights.sbomify.com/CVE-2024-7853/): SourceCodester Yoga Class Registration System sql injection (medium 5.3)
- [CVE-2024-7852](https://insights.sbomify.com/CVE-2024-7852/): SourceCodester Yoga Class Registration System view_inquiry.php cross site scripting (medium 5.3)
- [CVE-2024-7851](https://insights.sbomify.com/CVE-2024-7851/): SourceCodester Yoga Class Registration System Add User Users.php improper authorization (medium 5.3)
- [CVE-2024-7850](https://insights.sbomify.com/CVE-2024-7850/): BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-7849](https://insights.sbomify.com/CVE-2024-7849/): D-Link DNS-1550-04 photocenter_mgr.cgi cgi_create_album buffer overflow (high 8.7)
- [CVE-2024-7848](https://insights.sbomify.com/CVE-2024-7848/): User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access (medium 4.3)
- [CVE-2024-7847](https://insights.sbomify.com/CVE-2024-7847/): RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script (high 8.8)
- [CVE-2024-7846](https://insights.sbomify.com/CVE-2024-7846/): YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-7845](https://insights.sbomify.com/CVE-2024-7845/): SourceCodester Online Graduate Tracer System fetch_it.php sql injection (medium 5.3)
- [CVE-2024-7844](https://insights.sbomify.com/CVE-2024-7844/): SourceCodester Online Graduate Tracer System add_acc.php cross site scripting (medium 5.3)
- [CVE-2024-7843](https://insights.sbomify.com/CVE-2024-7843/): SourceCodester Online Graduate Tracer System exportcs.php information disclosure (medium 6.9)
- [CVE-2024-7842](https://insights.sbomify.com/CVE-2024-7842/): SourceCodester Online Graduate Tracer System export_it.php information disclosure (medium 6.9)
- [CVE-2024-7841](https://insights.sbomify.com/CVE-2024-7841/): SourceCodester Clinics Patient Management System check_user_name.php sql injection (medium 5.3)
- [CVE-2024-7840](https://insights.sbomify.com/CVE-2024-7840/): Improper neutralization special element in hyperlinks (high 7.8)
- [CVE-2024-7839](https://insights.sbomify.com/CVE-2024-7839/): itsourcecode Billing System addbill.php sql injection (medium 6.9)
- [CVE-2024-7838](https://insights.sbomify.com/CVE-2024-7838/): itsourcecode Online Food Ordering System addcategory.php sql injection (medium 6.9)
- [CVE-2024-7837](https://insights.sbomify.com/CVE-2024-7837/): SQLi in Firmanet Software's ERP (high 8.2)
- [CVE-2024-7836](https://insights.sbomify.com/CVE-2024-7836/): Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication (medium 4.3)
- [CVE-2024-7835](https://insights.sbomify.com/CVE-2024-7835/): Reflected XSS in Exnet Informatics Software's Ferry Reservation System (high 8.8)
- [CVE-2024-7834](https://insights.sbomify.com/CVE-2024-7834/): Local privilege escalation in Overwolf (high 7.8)
- [CVE-2024-7833](https://insights.sbomify.com/CVE-2024-7833/): D-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injection (medium 5.3)
- [CVE-2024-7832](https://insights.sbomify.com/CVE-2024-7832/): D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_fullscreen_photos buffer overflow (high 8.7)
- [CVE-2024-7831](https://insights.sbomify.com/CVE-2024-7831/): D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_cooliris buffer overflow (high 8.7)
- [CVE-2024-7830](https://insights.sbomify.com/CVE-2024-7830/): D-Link DNS-1550-04 photocenter_mgr.cgi cgi_move_photo buffer overflow (high 8.7)
- [CVE-2024-7829](https://insights.sbomify.com/CVE-2024-7829/): D-Link DNS-1550-04 photocenter_mgr.cgi cgi_del_photo buffer overflow (high 8.7)
- [CVE-2024-7828](https://insights.sbomify.com/CVE-2024-7828/): D-Link DNS-1550-04 photocenter_mgr.cgi cgi_set_cover buffer overflow (high 8.7)
- [CVE-2024-7827](https://insights.sbomify.com/CVE-2024-7827/): Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter (high 8.8)
- [CVE-2024-7826](https://insights.sbomify.com/CVE-2024-7826/): Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dump (medium 6.2)
- [CVE-2024-7825](https://insights.sbomify.com/CVE-2024-7825/): Type confusion that can cause the WRSA.exe service to crash and generate a crash dump (medium 6.2)
- [CVE-2024-7824](https://insights.sbomify.com/CVE-2024-7824/): Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dump (medium 6.3)
- [CVE-2024-7822](https://insights.sbomify.com/CVE-2024-7822/): Quick Code <= 1.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-7820](https://insights.sbomify.com/CVE-2024-7820/): ILC Thickbox <= 1.0 - Settings update via CSRF (medium 4.3)
- [CVE-2024-7819](https://insights.sbomify.com/CVE-2024-7819/): CORS Misconfiguration in danswer-ai/danswer (high 7.4)
- [CVE-2024-7818](https://insights.sbomify.com/CVE-2024-7818/): Misiek Photo Album <= 1.4.3 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-7817](https://insights.sbomify.com/CVE-2024-7817/): Misiek Photo Album <= 1.4.3 - Album Deletion via CSRF (medium 6.5)
- [CVE-2024-7816](https://insights.sbomify.com/CVE-2024-7816/): Gixaw Chat <= 1.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-7815](https://insights.sbomify.com/CVE-2024-7815/): CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting (medium 5.1)
- [CVE-2024-7814](https://insights.sbomify.com/CVE-2024-7814/): CodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scripting (medium 5.1)
- [CVE-2024-7813](https://insights.sbomify.com/CVE-2024-7813/): SourceCodester Prison Management System Profile Image insufficiently protected credentials (medium 6.9)
- [CVE-2024-7812](https://insights.sbomify.com/CVE-2024-7812/): SourceCodester Best House Rental Management System POST Parameter ajax.php cross site scripting (medium 5.3)
- [CVE-2024-7811](https://insights.sbomify.com/CVE-2024-7811/): SourceCodester Daily Expenses Monitoring App delete-expense.php sql injection (medium 5.3)
- [CVE-2024-7810](https://insights.sbomify.com/CVE-2024-7810/): SourceCodester Online Graduate Tracer System view_itprofile.php sql injection (medium 5.3)
- [CVE-2024-7809](https://insights.sbomify.com/CVE-2024-7809/): SourceCodester Online Graduate Tracer System nbproject exposure of information through directory listing (medium 6.9)
- [CVE-2024-7808](https://insights.sbomify.com/CVE-2024-7808/): code-projects Job Portal logindbc.php sql injection (medium 6.9)
- [CVE-2024-7807](https://insights.sbomify.com/CVE-2024-7807/): Denial of Service (DOS) in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-7803](https://insights.sbomify.com/CVE-2024-7803/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-7801](https://insights.sbomify.com/CVE-2024-7801/): SQL injection in get_chart_data in TimeProvider 4100 (medium 6.3)
- [CVE-2024-7800](https://insights.sbomify.com/CVE-2024-7800/): SourceCodester Simple Online Bidding System ajax.php sql injection (medium 5.3)
- [CVE-2024-7799](https://insights.sbomify.com/CVE-2024-7799/): SourceCodester Simple Online Bidding System users.php improper authorization (medium 6.9)
- [CVE-2024-7798](https://insights.sbomify.com/CVE-2024-7798/): SourceCodester Simple Online Bidding System ajax.php sql injection (medium 6.9)
- [CVE-2024-7797](https://insights.sbomify.com/CVE-2024-7797/): SourceCodester Simple Online Bidding System ajax.php sql injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/156/