# Vulnerabilities published in 2024


- [CVE-2024-6929](https://insights.sbomify.com/CVE-2024-6929/): Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter (medium 6.4)
- [CVE-2024-6928](https://insights.sbomify.com/CVE-2024-6928/): Opti Marketing <= 2.0.9 - Unauthenticated SQLi (critical 9.8)
- [CVE-2024-6927](https://insights.sbomify.com/CVE-2024-6927/): Viral Signup <= 2.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6926](https://insights.sbomify.com/CVE-2024-6926/): Viral Signup <= 2.1 - Unauthenticated SQLi (critical 9.8)
- [CVE-2024-6925](https://insights.sbomify.com/CVE-2024-6925/): TrueBooker < 1.0.3 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-6924](https://insights.sbomify.com/CVE-2024-6924/): TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi (critical 9.8)
- [CVE-2024-6923](https://insights.sbomify.com/CVE-2024-6923/): Email header injection due to unquoted newlines (medium 5.5)
- [CVE-2024-6922](https://insights.sbomify.com/CVE-2024-6922/): Server-Side Request Forgery in Automation 360 (medium 6.9)
- [CVE-2024-6921](https://insights.sbomify.com/CVE-2024-6921/): Cleartext Username and Password in NAC Telecommunication's NACPremium (high 8.7)
- [CVE-2024-6920](https://insights.sbomify.com/CVE-2024-6920/): Stored XSS in NAC Telecommunication's NACPremium (medium 4.8)
- [CVE-2024-6919](https://insights.sbomify.com/CVE-2024-6919/): SQLi in NAC Telecommunication's NACPremium (critical 9.3)
- [CVE-2024-6918](https://insights.sbomify.com/CVE-2024-6918/): Memory corruption in Accutech Manager (high 7.5)
- [CVE-2024-6917](https://insights.sbomify.com/CVE-2024-6917/): RCE in Veribilim Software's Veribase Order Management (critical 10.0)
- [CVE-2024-6916](https://insights.sbomify.com/CVE-2024-6916/): Zowe CLI --show-inputs-only displays securely stored properties (medium 5.9)
- [CVE-2024-6915](https://insights.sbomify.com/CVE-2024-6915/): JFrog Artifactory Cache Poisoning (critical 9.3)
- [CVE-2024-6914](https://insights.sbomify.com/CVE-2024-6914/): Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover (critical 9.8)
- [CVE-2024-6913](https://insights.sbomify.com/CVE-2024-6913/): Execution with Unnecessary Privileges (critical 9.3)
- [CVE-2024-6912](https://insights.sbomify.com/CVE-2024-6912/): Hardcoded MSSQL Credentials (critical 9.3)
- [CVE-2024-6911](https://insights.sbomify.com/CVE-2024-6911/): Unauthenticated Local File Inclusion (high 8.7)
- [CVE-2024-6910](https://insights.sbomify.com/CVE-2024-6910/): EventON < 2.2.17 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6908](https://insights.sbomify.com/CVE-2024-6908/): Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request (medium 6.0)
- [CVE-2024-6907](https://insights.sbomify.com/CVE-2024-6907/): SourceCodester Record Management System sort.php cross site scripting (medium 5.3)
- [CVE-2024-6906](https://insights.sbomify.com/CVE-2024-6906/): SourceCodester Record Management System add_leave_non_user.php sql injection (medium 5.3)
- [CVE-2024-6905](https://insights.sbomify.com/CVE-2024-6905/): SourceCodester Record Management System view_info_user.php sql injection (medium 5.3)
- [CVE-2024-6904](https://insights.sbomify.com/CVE-2024-6904/): SourceCodester Record Management System sort2_user.php sql injection (medium 5.3)
- [CVE-2024-6903](https://insights.sbomify.com/CVE-2024-6903/): SourceCodester Record Management System sort1_user.php sql injection (medium 5.3)
- [CVE-2024-6902](https://insights.sbomify.com/CVE-2024-6902/): SourceCodester Record Management System sort_user.php sql injection (medium 5.3)
- [CVE-2024-6901](https://insights.sbomify.com/CVE-2024-6901/): SourceCodester Record Management System entry.php sql injection (medium 5.3)
- [CVE-2024-6900](https://insights.sbomify.com/CVE-2024-6900/): SourceCodester Record Management System edit_emp.php sql injection (medium 5.3)
- [CVE-2024-6899](https://insights.sbomify.com/CVE-2024-6899/): SourceCodester Record Management System view_info.php sql injection (medium 5.3)
- [CVE-2024-6898](https://insights.sbomify.com/CVE-2024-6898/): SourceCodester Record Management System index.php sql injection (medium 6.9)
- [CVE-2024-6897](https://insights.sbomify.com/CVE-2024-6897/): aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-6896](https://insights.sbomify.com/CVE-2024-6896/): Cross-site scripting in AMP for WP – Accelerated Mobile Pages (medium 6.4)
- [CVE-2024-6895](https://insights.sbomify.com/CVE-2024-6895/): Insecure Account Profile Management (medium 6.1)
- [CVE-2024-6894](https://insights.sbomify.com/CVE-2024-6894/): RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6893](https://insights.sbomify.com/CVE-2024-6893/): Journyx Unauthenticated XML External Entities Injection (high 7.5)
- [CVE-2024-6892](https://insights.sbomify.com/CVE-2024-6892/): Journyx Reflected Cross Site Scripting (medium 6.1)
- [CVE-2024-6891](https://insights.sbomify.com/CVE-2024-6891/): Journyx Authenticated Remote Code Execution (high 8.8)
- [CVE-2024-6890](https://insights.sbomify.com/CVE-2024-6890/): Journyx Unauthenticated Password Reset Bruteforce (critical 9.8)
- [CVE-2024-6889](https://insights.sbomify.com/CVE-2024-6889/): Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6888](https://insights.sbomify.com/CVE-2024-6888/): Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6887](https://insights.sbomify.com/CVE-2024-6887/): Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-6886](https://insights.sbomify.com/CVE-2024-6886/): Inproper Sanitation of field leading to stored XSS (critical 10.0)
- [CVE-2024-6885](https://insights.sbomify.com/CVE-2024-6885/): Path traversal in MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites (high 8.1)
- [CVE-2024-6884](https://insights.sbomify.com/CVE-2024-6884/): Gutenberg Blocks with AI by Kadence WP < 3.2.39 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-6883](https://insights.sbomify.com/CVE-2024-6883/): Missing authorization in Event Espresso – Event Registration & Ticketing Sales (medium 4.3)
- [CVE-2024-6881](https://insights.sbomify.com/CVE-2024-6881/): Stored XSS Vulnerability (high 8.5)
- [CVE-2024-6880](https://insights.sbomify.com/CVE-2024-6880/): CSRF in MegaBIP (medium 6.9)
- [CVE-2024-6879](https://insights.sbomify.com/CVE-2024-6879/): Quiz and Survey Master (QSM) < 9.1.1 - Contributor+ Stored XSS (medium 4.7)
- [CVE-2024-6878](https://insights.sbomify.com/CVE-2024-6878/): Directory Browsing in Eliz Software's Panel (critical 9.2)
- [CVE-2024-6877](https://insights.sbomify.com/CVE-2024-6877/): Reflected XSS in Eliz Software's Panel (critical 9.4)
- [CVE-2024-6876](https://insights.sbomify.com/CVE-2024-6876/): Out-of-bounds read in OSCAT-Library (medium 4.4)
- [CVE-2024-6875](https://insights.sbomify.com/CVE-2024-6875/): Infinispan: infinispan: rest compare api has buffer leak (medium 6.5)
- [CVE-2024-6874](https://insights.sbomify.com/CVE-2024-6874/): macidn punycode buffer overread (low 3.1)
- [CVE-2024-6873](https://insights.sbomify.com/CVE-2024-6873/): Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution. (high 8.1)
- [CVE-2024-6872](https://insights.sbomify.com/CVE-2024-6872/): Missing authorization in TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder (medium 4.3)
- [CVE-2024-6871](https://insights.sbomify.com/CVE-2024-6871/): G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.0)
- [CVE-2024-6870](https://insights.sbomify.com/CVE-2024-6870/): Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (medium 6.4)
- [CVE-2024-6869](https://insights.sbomify.com/CVE-2024-6869/): Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure (medium 5.4)
- [CVE-2024-6868](https://insights.sbomify.com/CVE-2024-6868/): Arbitrary File Write in mudler/LocalAI (high 8.1)
- [CVE-2024-6867](https://insights.sbomify.com/CVE-2024-6867/): Information Disclosure in lunary-ai/lunary (medium 4.3)
- [CVE-2024-6866](https://insights.sbomify.com/CVE-2024-6866/): Case-Insensitive Path Matching in corydolphin/flask-cors (medium 5.3)
- [CVE-2024-6864](https://insights.sbomify.com/CVE-2024-6864/): Cross-site scripting in WP Last Modified Info (medium 6.4)
- [CVE-2024-6863](https://insights.sbomify.com/CVE-2024-6863/): Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 (medium 6.5)
- [CVE-2024-6862](https://insights.sbomify.com/CVE-2024-6862/): Cross-Site Request Forgery (CSRF) in lunary-ai/lunary (high 7.4)
- [CVE-2024-6861](https://insights.sbomify.com/CVE-2024-6861/): Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api (high 7.5)
- [CVE-2024-6860](https://insights.sbomify.com/CVE-2024-6860/): WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF (medium 4.3)
- [CVE-2024-6859](https://insights.sbomify.com/CVE-2024-6859/): WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode (medium 5.4)
- [CVE-2024-6858](https://insights.sbomify.com/CVE-2024-6858/): Auth bypass in EOS (medium 6.5)
- [CVE-2024-6857](https://insights.sbomify.com/CVE-2024-6857/): WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF (medium 4.3)
- [CVE-2024-6856](https://insights.sbomify.com/CVE-2024-6856/): WP MultiTasking <= 0.1.12 - SMTP Settings Update via CSRF (medium 6.5)
- [CVE-2024-6855](https://insights.sbomify.com/CVE-2024-6855/): WP MultiTasking <= 0.1.12 - Exit Popup Update via CSRF (medium 6.5)
- [CVE-2024-6854](https://insights.sbomify.com/CVE-2024-6854/): Arbitrary File Overwrite in h2oai/h2o-3 (high 7.1)
- [CVE-2024-6853](https://insights.sbomify.com/CVE-2024-6853/): WP MultiTasking <= 0.1.12 - Welcome Popup Update via CSRF (medium 6.5)
- [CVE-2024-6852](https://insights.sbomify.com/CVE-2024-6852/): WP MultiTasking <= 0.1.12 - Settings Update via CSRF (medium 6.5)
- [CVE-2024-6851](https://insights.sbomify.com/CVE-2024-6851/): Arbitrary File Deletion in aimhubio/aim (high 7.5)
- [CVE-2024-6850](https://insights.sbomify.com/CVE-2024-6850/): Carousel Slider < 2.2.14 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-6849](https://insights.sbomify.com/CVE-2024-6849/): Cross-site scripting in Preloader Plus – WordPress Loading Screen Plugin (medium 6.4)
- [CVE-2024-6848](https://insights.sbomify.com/CVE-2024-6848/): Cross-site scripting in Post and Page Builder by BoldGrid – Visual Drag and Drop Editor (medium 6.4)
- [CVE-2024-6847](https://insights.sbomify.com/CVE-2024-6847/): SmartSearch WP <= 2.4.4 - Unauthenticated SQLi (critical 9.8)
- [CVE-2024-6846](https://insights.sbomify.com/CVE-2024-6846/): SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge (medium 5.3)
- [CVE-2024-6845](https://insights.sbomify.com/CVE-2024-6845/): SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure (medium 5.3)
- [CVE-2024-6844](https://insights.sbomify.com/CVE-2024-6844/): Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors (medium 5.3)
- [CVE-2024-6843](https://insights.sbomify.com/CVE-2024-6843/): SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-6842](https://insights.sbomify.com/CVE-2024-6842/): Exposure of Sensitive Information in mintplex-labs/anything-llm (high 7.5)
- [CVE-2024-6841](https://insights.sbomify.com/CVE-2024-6841/): CSRF in vanna-ai/vanna (medium 6.5)
- [CVE-2024-6840](https://insights.sbomify.com/CVE-2024-6840/): Automation-controller: gain access to the k8s api server via job execution with container group (medium 6.6)
- [CVE-2024-6839](https://insights.sbomify.com/CVE-2024-6839/): Improper Regex Path Matching in corydolphin/flask-cors (medium 4.3)
- [CVE-2024-6838](https://insights.sbomify.com/CVE-2024-6838/): Uncontrolled Resource Consumption in mlflow/mlflow (medium 5.3)
- [CVE-2024-6836](https://insights.sbomify.com/CVE-2024-6836/): Missing authorization in FunnelKit – Funnel Builder for WooCommerce Checkout (medium 4.3)
- [CVE-2024-6835](https://insights.sbomify.com/CVE-2024-6835/): Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form (medium 5.3)
- [CVE-2024-6834](https://insights.sbomify.com/CVE-2024-6834/): Imperative Local Command Injection allows Activity Masking (critical 9.0)
- [CVE-2024-6833](https://insights.sbomify.com/CVE-2024-6833/): Zowe CLI Auto-Init Leaks Credentials Locally (medium 5.9)
- [CVE-2024-6832](https://insights.sbomify.com/CVE-2024-6832/): Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks (medium 5.9)
- [CVE-2024-6831](https://insights.sbomify.com/CVE-2024-6831/): Missing authorization in AXIS Camera Station (medium 4.4)
- [CVE-2024-6830](https://insights.sbomify.com/CVE-2024-6830/): SourceCodester Simple Inventory Management System Order action.php sql injection (medium 5.3)
- [CVE-2024-6829](https://insights.sbomify.com/CVE-2024-6829/): Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim (critical 9.1)
- [CVE-2024-6828](https://insights.sbomify.com/CVE-2024-6828/): Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-6827](https://insights.sbomify.com/CVE-2024-6827/): HTTP Request Smuggling in benoitc/gunicorn (high 7.5)
- [CVE-2024-6826](https://insights.sbomify.com/CVE-2024-6826/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/165/