# Vulnerabilities published in 2024


- [CVE-2024-7795](https://insights.sbomify.com/CVE-2024-7795/): Memory corruption in MaxiCharger AC Elite Business C50 (high 8.8)
- [CVE-2024-7794](https://insights.sbomify.com/CVE-2024-7794/): itsourcecode Vehicle Management System mybill.php sql injection (medium 5.3)
- [CVE-2024-7793](https://insights.sbomify.com/CVE-2024-7793/): SourceCodester Task Progress Tracker add-task.php cross site scripting (medium 5.3)
- [CVE-2024-7792](https://insights.sbomify.com/CVE-2024-7792/): SourceCodester Task Progress Tracker delete-task.php sql injection (medium 5.3)
- [CVE-2024-7791](https://insights.sbomify.com/CVE-2024-7791/): Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (medium 6.4)
- [CVE-2024-7790](https://insights.sbomify.com/CVE-2024-7790/): DevikaAI Stored Cross-Site Scripting (medium 6.5)
- [CVE-2024-7788](https://insights.sbomify.com/CVE-2024-7788/): Signatures in "repair mode" should not be trusted (high 7.8)
- [CVE-2024-7787](https://insights.sbomify.com/CVE-2024-7787/): Reflected XSS in ITG Computer Technology's vSRM Supplier Relationship Management System (medium 5.1)
- [CVE-2024-7786](https://insights.sbomify.com/CVE-2024-7786/): Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak (high 7.5)
- [CVE-2024-7785](https://insights.sbomify.com/CVE-2024-7785/): Reflected XSS in Ece Software's Electronic Ticket System (critical 9.3)
- [CVE-2024-7784](https://insights.sbomify.com/CVE-2024-7784/): Security feature bypass in AXIS OS (medium 6.1)
- [CVE-2024-7783](https://insights.sbomify.com/CVE-2024-7783/): Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm (medium 5.9)
- [CVE-2024-7782](https://insights.sbomify.com/CVE-2024-7782/): Path traversal in Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder (high 8.7)
- [CVE-2024-7781](https://insights.sbomify.com/CVE-2024-7781/): Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover (high 8.1)
- [CVE-2024-7780](https://insights.sbomify.com/CVE-2024-7780/): SQL injection in Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder (high 7.2)
- [CVE-2024-7779](https://insights.sbomify.com/CVE-2024-7779/): ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer (high 7.5)
- [CVE-2024-7778](https://insights.sbomify.com/CVE-2024-7778/): Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-7777](https://insights.sbomify.com/CVE-2024-7777/): Path traversal in Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder (critical 9.0)
- [CVE-2024-7776](https://insights.sbomify.com/CVE-2024-7776/): Arbitrary File Overwrite in onnx/onnx (high 8.1)
- [CVE-2024-7775](https://insights.sbomify.com/CVE-2024-7775/): File upload in Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder (medium 5.5)
- [CVE-2024-7774](https://insights.sbomify.com/CVE-2024-7774/): Path Traversal in langchain-ai/langchainjs (medium 6.5)
- [CVE-2024-7772](https://insights.sbomify.com/CVE-2024-7772/): Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-7771](https://insights.sbomify.com/CVE-2024-7771/): Denial of Service in mintplex-labs/anything-llm (medium 6.5)
- [CVE-2024-7770](https://insights.sbomify.com/CVE-2024-7770/): File upload in File Manager (high 8.8)
- [CVE-2024-7769](https://insights.sbomify.com/CVE-2024-7769/): Wordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSS (medium 4.8)
- [CVE-2024-7768](https://insights.sbomify.com/CVE-2024-7768/): Denial of Service in h2oai/h2o-3 (high 7.5)
- [CVE-2024-7767](https://insights.sbomify.com/CVE-2024-7767/): Improper Access Control in danswer-ai/danswer (medium 6.5)
- [CVE-2024-7766](https://insights.sbomify.com/CVE-2024-7766/): Adicon Server <= 1.2 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-7765](https://insights.sbomify.com/CVE-2024-7765/): Denial of Service in h2oai/h2o-3 (high 7.5)
- [CVE-2024-7764](https://insights.sbomify.com/CVE-2024-7764/): SQL Injection in vanna-ai/vanna (high 8.1)
- [CVE-2024-7763](https://insights.sbomify.com/CVE-2024-7763/): WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2024-7762](https://insights.sbomify.com/CVE-2024-7762/): Simple Job Board < 2.12.6 - Unauthenticated Resumes Download (low 3.7)
- [CVE-2024-7761](https://insights.sbomify.com/CVE-2024-7761/): Simple Job Board < 2.12.2 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-7760](https://insights.sbomify.com/CVE-2024-7760/): CSRF in aimhubio/aim (high 7.4)
- [CVE-2024-7759](https://insights.sbomify.com/CVE-2024-7759/): PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS (medium 4.8)
- [CVE-2024-7758](https://insights.sbomify.com/CVE-2024-7758/): Stylish Price List < 7.1.8 - Contributor+ Stored XSS (medium 4.8)
- [CVE-2024-7756](https://insights.sbomify.com/CVE-2024-7756/): Privilege escalation in 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS (medium 6.8)
- [CVE-2024-7755](https://insights.sbomify.com/CVE-2024-7755/): HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials (high 7.1)
- [CVE-2024-7754](https://insights.sbomify.com/CVE-2024-7754/): SourceCodester Clinics Patient Management System check_medicine_name.php sql injection (medium 5.3)
- [CVE-2024-7753](https://insights.sbomify.com/CVE-2024-7753/): SourceCodester Clinics Patient Management System user_images direct request (medium 6.9)
- [CVE-2024-7752](https://insights.sbomify.com/CVE-2024-7752/): SourceCodester Clinics Patient Management System update_medicine.php cross site scripting (medium 5.3)
- [CVE-2024-7751](https://insights.sbomify.com/CVE-2024-7751/): SourceCodester Clinics Patient Management System update_medicine.php sql injection (medium 5.3)
- [CVE-2024-7750](https://insights.sbomify.com/CVE-2024-7750/): SourceCodester Clinics Patient Management System medicines.php sql injection (medium 5.3)
- [CVE-2024-7749](https://insights.sbomify.com/CVE-2024-7749/): SourceCodester Accounts Manager App add-account.php cross site scripting (medium 5.3)
- [CVE-2024-7748](https://insights.sbomify.com/CVE-2024-7748/): SourceCodester Accounts Manager App delete-account.php sql injection (medium 5.3)
- [CVE-2024-7747](https://insights.sbomify.com/CVE-2024-7747/): Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types (medium 6.5)
- [CVE-2024-7746](https://insights.sbomify.com/CVE-2024-7746/): Use of default credentials at Traccar fleet management solution (critical 9.5)
- [CVE-2024-7745](https://insights.sbomify.com/CVE-2024-7745/): Multi-Factor Authentication Bypass in Progress WS_FTP Server (medium 6.5)
- [CVE-2024-7744](https://insights.sbomify.com/CVE-2024-7744/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP Server (medium 6.5)
- [CVE-2024-7743](https://insights.sbomify.com/CVE-2024-7743/): wanglongcn ltcms API Endpoint downloadUrl server-side request forgery (medium 6.9)
- [CVE-2024-7742](https://insights.sbomify.com/CVE-2024-7742/): wanglongcn ltcms API Endpoint multiDownload server-side request forgery (medium 6.9)
- [CVE-2024-7741](https://insights.sbomify.com/CVE-2024-7741/): wanglongcn ltcms API Endpoint downloadfile downloadFile path traversal (medium 6.9)
- [CVE-2024-7740](https://insights.sbomify.com/CVE-2024-7740/): wanglongcn ltcms API Endpoint download server-side request forgery (medium 6.9)
- [CVE-2024-7739](https://insights.sbomify.com/CVE-2024-7739/): yzane vscode-markdown-pdf cross site scripting (medium 6.9)
- [CVE-2024-7738](https://insights.sbomify.com/CVE-2024-7738/): yzane vscode-markdown-pdf Markdown File pathname traversal (medium 4.8)
- [CVE-2024-7737](https://insights.sbomify.com/CVE-2024-7737/): Cross-site scripting in 3DSwymer (high 8.7)
- [CVE-2024-7736](https://insights.sbomify.com/CVE-2024-7736/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-7735](https://insights.sbomify.com/CVE-2024-7735/): SQLi in Exnet Informatics Software's Ferry Reservation System (critical 9.3)
- [CVE-2024-7734](https://insights.sbomify.com/CVE-2024-7734/): Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors. (medium 5.3)
- [CVE-2024-7733](https://insights.sbomify.com/CVE-2024-7733/): FastCMS New Article Category Page cross site scripting (medium 5.3)
- [CVE-2024-7732](https://insights.sbomify.com/CVE-2024-7732/): SECOM Dr.ID Attendance system - Unrestricted File Upload (critical 9.8)
- [CVE-2024-7731](https://insights.sbomify.com/CVE-2024-7731/): SECOM Dr.ID Access control system - SQL injection (critical 9.8)
- [CVE-2024-7730](https://insights.sbomify.com/CVE-2024-7730/): Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb() (high 7.4)
- [CVE-2024-7729](https://insights.sbomify.com/CVE-2024-7729/): CAYIN Technology CMS - Sensitive File Download (high 7.5)
- [CVE-2024-7728](https://insights.sbomify.com/CVE-2024-7728/): CAYIN Technology CMS - OS Command Injection (high 7.2)
- [CVE-2024-7727](https://insights.sbomify.com/CVE-2024-7727/): Missing authorization in HTML5 Video Player – Embed and Play Videos in Custom Player (medium 5.3)
- [CVE-2024-7726](https://insights.sbomify.com/CVE-2024-7726/): Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7 (medium 5.7)
- [CVE-2024-7725](https://insights.sbomify.com/CVE-2024-7725/): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7724](https://insights.sbomify.com/CVE-2024-7724/): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7723](https://insights.sbomify.com/CVE-2024-7723/): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7722](https://insights.sbomify.com/CVE-2024-7722/): Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-7721](https://insights.sbomify.com/CVE-2024-7721/): Missing authorization in HTML5 Video Player – Embed and Play Videos in Custom Player (medium 4.3)
- [CVE-2024-7720](https://insights.sbomify.com/CVE-2024-7720/): HP Security Manager - Potential Remote Code Execution (critical 9.8)
- [CVE-2024-7717](https://insights.sbomify.com/CVE-2024-7717/): WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection (high 8.8)
- [CVE-2024-7716](https://insights.sbomify.com/CVE-2024-7716/): GS Logo Slider Lite < 3.6.9 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7715](https://insights.sbomify.com/CVE-2024-7715/): D-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injection (medium 5.3)
- [CVE-2024-7714](https://insights.sbomify.com/CVE-2024-7714/): AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls (medium 6.5)
- [CVE-2024-7713](https://insights.sbomify.com/CVE-2024-7713/): AI Chatbot with ChatGPT by AYS <= 2.0.9 - Unauthenticated OpenAI Key Disclosure (high 7.5)
- [CVE-2024-7711](https://insights.sbomify.com/CVE-2024-7711/): Missing authorization in GitHub Enterprise Server (medium 5.3)
- [CVE-2024-7709](https://insights.sbomify.com/CVE-2024-7709/): OcoMon URL require_access_recovery.php cross site scripting (medium 6.9)
- [CVE-2024-7708](https://insights.sbomify.com/CVE-2024-7708/): Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests (high 7.5)
- [CVE-2024-7707](https://insights.sbomify.com/CVE-2024-7707/): Tenda FH1206 HTTP POST Request SafeEmailFilter formSafeEmailFilter stack-based overflow (high 8.7)
- [CVE-2024-7706](https://insights.sbomify.com/CVE-2024-7706/): Fujian mwcms uploadfile.html uploadimage unrestricted upload (medium 5.1)
- [CVE-2024-7705](https://insights.sbomify.com/CVE-2024-7705/): Fujian mwcms Image Upload uploadeditor.html uploadeditor unrestricted upload (medium 5.1)
- [CVE-2024-7704](https://insights.sbomify.com/CVE-2024-7704/): Weaver e-cology Source Code ecology_dev.zip information disclosure (medium 6.9)
- [CVE-2024-7703](https://insights.sbomify.com/CVE-2024-7703/): Cross-site scripting in ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup (medium 6.4)
- [CVE-2024-7702](https://insights.sbomify.com/CVE-2024-7702/): SQL injection in Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder (high 7.2)
- [CVE-2024-7701](https://insights.sbomify.com/CVE-2024-7701/): Misuse of SHA256 to create an encryption key (medium 5.1)
- [CVE-2024-7700](https://insights.sbomify.com/CVE-2024-7700/): Foreman: command injection in "host init config" template via "install packages" field on foreman (medium 6.5)
- [CVE-2024-7699](https://insights.sbomify.com/CVE-2024-7699/): Phoenix Contact: OS command execution in MGUARD products (high 8.8)
- [CVE-2024-7698](https://insights.sbomify.com/CVE-2024-7698/): Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products (medium 5.7)
- [CVE-2024-7697](https://insights.sbomify.com/CVE-2024-7697/): Logical vulnerability in com.transsion.carlcare (high 7.5)
- [CVE-2024-7696](https://insights.sbomify.com/CVE-2024-7696/): Other in AXIS Camera Station Pro (medium 6.3)
- [CVE-2024-7695](https://insights.sbomify.com/CVE-2024-7695/): Out-of-bounds Write Vulnerability (high 8.7)
- [CVE-2024-7694](https://insights.sbomify.com/CVE-2024-7694/): TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type (high 7.2, exploited in the wild)
- [CVE-2024-7693](https://insights.sbomify.com/CVE-2024-7693/): Team Johnlong software Raiden MAILD Remote Management System - Arbitrary File Reading through Path Traversal (high 7.5)
- [CVE-2024-7692](https://insights.sbomify.com/CVE-2024-7692/): Flaming Forms <= 1.0.1 - Reflected XSS (medium 6.1)
- [CVE-2024-7691](https://insights.sbomify.com/CVE-2024-7691/): Flaming Forms <= 1.0.1 - Unauthenticated Stored XSS (medium 5.4)
- [CVE-2024-7690](https://insights.sbomify.com/CVE-2024-7690/): DN Popup <= 1.2.2 - Settings Update via CSRF (medium 5.4)
- [CVE-2024-7689](https://insights.sbomify.com/CVE-2024-7689/): Snapshot Backup <= 2.1.1 - Stored XSS via CSRF (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/157/