# Vulnerabilities published in 2024


- [CVE-2024-6282](https://insights.sbomify.com/CVE-2024-6282/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 5.4)
- [CVE-2024-6281](https://insights.sbomify.com/CVE-2024-6281/): Path Traversal in parisneo/lollms (high 7.3)
- [CVE-2024-6280](https://insights.sbomify.com/CVE-2024-6280/): SourceCodester Simple Online Bidding System unrestricted upload (medium 5.3)
- [CVE-2024-6279](https://insights.sbomify.com/CVE-2024-6279/): lahirudanushka School Management System Exam Results Page examresults-par.php sql injection (medium 5.3)
- [CVE-2024-6278](https://insights.sbomify.com/CVE-2024-6278/): lahirudanushka School Management System Subject Page subject.php sql injection (medium 5.1)
- [CVE-2024-6277](https://insights.sbomify.com/CVE-2024-6277/): lahirudanushka School Management System Student Page student.php sql injection (medium 5.1)
- [CVE-2024-6276](https://insights.sbomify.com/CVE-2024-6276/): lahirudanushka School Management System Teacher Page teacher.php sql injection (medium 5.1)
- [CVE-2024-6275](https://insights.sbomify.com/CVE-2024-6275/): lahirudanushka School Management System Parent Page parent.php sql injection (medium 5.1)
- [CVE-2024-6274](https://insights.sbomify.com/CVE-2024-6274/): lahirudanushka School Management System Attendance Report Page attendancelist.php sql injection (medium 5.1)
- [CVE-2024-6273](https://insights.sbomify.com/CVE-2024-6273/): SourceCodester Clinic Queuing System patient_side.php save_patient cross site scripting (medium 6.9)
- [CVE-2024-6272](https://insights.sbomify.com/CVE-2024-6272/): SpiderContacts <= 1.1.7 - Reflected XSS (medium 6.1)
- [CVE-2024-6271](https://insights.sbomify.com/CVE-2024-6271/): Community Events < 1.5 - Event Deletion via CSRF (medium 5.4)
- [CVE-2024-6270](https://insights.sbomify.com/CVE-2024-6270/): Community Events < 1.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6269](https://insights.sbomify.com/CVE-2024-6269/): Ruijie RG-UAC HTTP POST Request sxh_vpnlic.php get_ip.addr_details command injection (medium 5.1)
- [CVE-2024-6268](https://insights.sbomify.com/CVE-2024-6268/): lahirudanushka School Management System Login Page login.php sql injection (medium 6.9)
- [CVE-2024-6267](https://insights.sbomify.com/CVE-2024-6267/): SourceCodester Service Provider Management System System Info Page index.php cross site scripting (medium 5.1)
- [CVE-2024-6266](https://insights.sbomify.com/CVE-2024-6266/): Pear Admin Boot loadDictItem sql injection (medium 5.3)
- [CVE-2024-6265](https://insights.sbomify.com/CVE-2024-6265/): SQL injection in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (critical 9.8)
- [CVE-2024-6264](https://insights.sbomify.com/CVE-2024-6264/): Post Meta Data Manager <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6263](https://insights.sbomify.com/CVE-2024-6263/): WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6262](https://insights.sbomify.com/CVE-2024-6262/): Portfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6261](https://insights.sbomify.com/CVE-2024-6261/): Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6260](https://insights.sbomify.com/CVE-2024-6260/): Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability (high 7.0)
- [CVE-2024-6259](https://insights.sbomify.com/CVE-2024-6259/): BT: HCI: adv_ext_report Improper discarding in adv_ext_report (high 7.6)
- [CVE-2024-6258](https://insights.sbomify.com/CVE-2024-6258/): BT: Missing length checks of net_buf in rfcomm_handle_data (medium 6.8)
- [CVE-2024-6257](https://insights.sbomify.com/CVE-2024-6257/): HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation (high 8.4)
- [CVE-2024-6256](https://insights.sbomify.com/CVE-2024-6256/): Cross-site scripting in Feeds for YouTube (YouTube video, channel, and gallery plugin) (medium 6.4)
- [CVE-2024-6255](https://insights.sbomify.com/CVE-2024-6255/): Path Traversal in gaizhenbiao/chuanhuchatgpt (high 8.2)
- [CVE-2024-6254](https://insights.sbomify.com/CVE-2024-6254/): Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-6253](https://insights.sbomify.com/CVE-2024-6253/): itsourcecode Online Food Ordering System purchase.php sql injection (medium 6.9)
- [CVE-2024-6252](https://insights.sbomify.com/CVE-2024-6252/): Zorlan SkyCaiji Task cross site scripting (medium 5.1)
- [CVE-2024-6251](https://insights.sbomify.com/CVE-2024-6251/): playSMS New Phonebook cross site scripting (medium 5.1)
- [CVE-2024-6250](https://insights.sbomify.com/CVE-2024-6250/): Absolute Path Traversal in parisneo/lollms-webui (high 7.5)
- [CVE-2024-6249](https://insights.sbomify.com/CVE-2024-6249/): Wyze Cam v3 TCP Traffic Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6248](https://insights.sbomify.com/CVE-2024-6248/): Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-6247](https://insights.sbomify.com/CVE-2024-6247/): Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-6246](https://insights.sbomify.com/CVE-2024-6246/): Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-6245](https://insights.sbomify.com/CVE-2024-6245/): Default Credentials in ssh service for SmartPlay in Maruti Suzuki (high 7.4)
- [CVE-2024-6244](https://insights.sbomify.com/CVE-2024-6244/): pz-frontend-manager < 1.0.6 - CSRF change user profile picture (high 8.8)
- [CVE-2024-6243](https://insights.sbomify.com/CVE-2024-6243/): HTML Forms < 1.3.33 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-6242](https://insights.sbomify.com/CVE-2024-6242/): Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices (high 7.3)
- [CVE-2024-6241](https://insights.sbomify.com/CVE-2024-6241/): Pear Admin Boot getDictItems sql injection (medium 5.3)
- [CVE-2024-6240](https://insights.sbomify.com/CVE-2024-6240/): Improper privilege management vulnerability in Parallels Desktop (high 7.7)
- [CVE-2024-6239](https://insights.sbomify.com/CVE-2024-6239/): Poppler: pdfinfo: crash in broken documents when using -dests parameter (high 7.5)
- [CVE-2024-6238](https://insights.sbomify.com/CVE-2024-6238/): pgAdmin 4 Installation Directory permission issue (high 7.4)
- [CVE-2024-6237](https://insights.sbomify.com/CVE-2024-6237/): 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request (medium 6.5)
- [CVE-2024-6236](https://insights.sbomify.com/CVE-2024-6236/): Denial of Service (high 7.1)
- [CVE-2024-6235](https://insights.sbomify.com/CVE-2024-6235/): Sensitive information disclosure (critical 9.4)
- [CVE-2024-6233](https://insights.sbomify.com/CVE-2024-6233/): Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-6232](https://insights.sbomify.com/CVE-2024-6232/): Regular-expression DoS when parsing TarFile headers (high 7.5)
- [CVE-2024-6231](https://insights.sbomify.com/CVE-2024-6231/): Request a Quote < 2.4.1 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-6230](https://insights.sbomify.com/CVE-2024-6230/): Pardakht Delkhah <= 2.9.8 - Form Fields Reset via CSRF (medium 6.5)
- [CVE-2024-6229](https://insights.sbomify.com/CVE-2024-6229/): Stored XSS in stangirard/quivr (medium 6.8)
- [CVE-2024-6228](https://insights.sbomify.com/CVE-2024-6228/): WANotifier < 2.6 - Subscriber+ LFI (high 7.5)
- [CVE-2024-6227](https://insights.sbomify.com/CVE-2024-6227/): Infinite Loop in aimhubio/aim (high 7.5)
- [CVE-2024-6226](https://insights.sbomify.com/CVE-2024-6226/): WpStickyBar <= 2.1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-6225](https://insights.sbomify.com/CVE-2024-6225/): Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-6224](https://insights.sbomify.com/CVE-2024-6224/): Send email only on Reply to My Comment <= 1.0.6 - Stored XSS via CSRF (medium 5.9)
- [CVE-2024-6223](https://insights.sbomify.com/CVE-2024-6223/): Send email only on Reply to My Comment <= 1.0.6 - Reflected XSS (medium 6.1)
- [CVE-2024-6222](https://insights.sbomify.com/CVE-2024-6222/): Security feature bypass in Docker Desktop (high 7.3)
- [CVE-2024-6221](https://insights.sbomify.com/CVE-2024-6221/): Improper Access Control in corydolphin/flask-cors (medium 6.5)
- [CVE-2024-6220](https://insights.sbomify.com/CVE-2024-6220/): 简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-6219](https://insights.sbomify.com/CVE-2024-6219/): lxd has a restricted TLS certificate privilege escalation when in PKI mode (low 3.8)
- [CVE-2024-6218](https://insights.sbomify.com/CVE-2024-6218/): itsourcecode Vehicle Management System busprofile.php sql injection (medium 6.9)
- [CVE-2024-6217](https://insights.sbomify.com/CVE-2024-6217/): SourceCodester Food Ordering Management System user-router.php sql injection (medium 5.3)
- [CVE-2024-6216](https://insights.sbomify.com/CVE-2024-6216/): SourceCodester Food Ordering Management System add-users.php sql injection (medium 5.3)
- [CVE-2024-6215](https://insights.sbomify.com/CVE-2024-6215/): SourceCodester Food Ordering Management System view-ticket-admin.php sql injection (medium 5.3)
- [CVE-2024-6214](https://insights.sbomify.com/CVE-2024-6214/): SourceCodester Food Ordering Management System add-item.php sql injection (medium 5.3)
- [CVE-2024-6213](https://insights.sbomify.com/CVE-2024-6213/): SourceCodester Food Ordering Management System Login Panel login.php sql injection (medium 6.9)
- [CVE-2024-6212](https://insights.sbomify.com/CVE-2024-6212/): SourceCodester Simple Student Attendance System student_form.php get_student cross site scripting (medium 5.3)
- [CVE-2024-6210](https://insights.sbomify.com/CVE-2024-6210/): Duplicator <= 1.5.9 - Full Path Disclosure (medium 5.3)
- [CVE-2024-6209](https://insights.sbomify.com/CVE-2024-6209/): unauthorized file access (critical 9.4)
- [CVE-2024-6208](https://insights.sbomify.com/CVE-2024-6208/): Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-6207](https://insights.sbomify.com/CVE-2024-6207/): Denial of service in Compact GuardLogix 5380 SIL 2 (high 8.7)
- [CVE-2024-6206](https://insights.sbomify.com/CVE-2024-6206/): Code injection in HPE Athonet Mobile Core (high 7.5)
- [CVE-2024-6205](https://insights.sbomify.com/CVE-2024-6205/): PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi (high 7.6)
- [CVE-2024-6204](https://insights.sbomify.com/CVE-2024-6204/): SQL injection (high 8.3)
- [CVE-2024-6203](https://insights.sbomify.com/CVE-2024-6203/): HaloITSM - Password Reset Poisoning (high 8.3)
- [CVE-2024-6202](https://insights.sbomify.com/CVE-2024-6202/): HaloITSM - SAML XML Signature Wrapping (XSW) (critical 9.8)
- [CVE-2024-6201](https://insights.sbomify.com/CVE-2024-6201/): HaloITSM - Emailing Template Injection (medium 5.3)
- [CVE-2024-6200](https://insights.sbomify.com/CVE-2024-6200/): HaloITSM - Stored Cross-Site Scripting in Tickets (high 8.0)
- [CVE-2024-6199](https://insights.sbomify.com/CVE-2024-6199/): Unauthenticated Remote Code Execution (high 7.7)
- [CVE-2024-6198](https://insights.sbomify.com/CVE-2024-6198/): SNORE Interface Unauthenticated Remote Code Execution (high 7.7)
- [CVE-2024-6197](https://insights.sbomify.com/CVE-2024-6197/): freeing stack buffer in utf8asn1str (high 7.5)
- [CVE-2024-6196](https://insights.sbomify.com/CVE-2024-6196/): itsourcecode Banking Management System admin_class.php sql injection (medium 6.9)
- [CVE-2024-6195](https://insights.sbomify.com/CVE-2024-6195/): itsourcecode Tailoring Management System orderadd.php sql injection (medium 5.3)
- [CVE-2024-6194](https://insights.sbomify.com/CVE-2024-6194/): itsourcecode Tailoring Management System editmeasurement.php sql injection (medium 5.3)
- [CVE-2024-6193](https://insights.sbomify.com/CVE-2024-6193/): itsourcecode Vehicle Management System driverprofile.php sql injection (medium 6.9)
- [CVE-2024-6192](https://insights.sbomify.com/CVE-2024-6192/): itsourcecode Loan Management System Login Page login.php sql injection (medium 6.9)
- [CVE-2024-6191](https://insights.sbomify.com/CVE-2024-6191/): itsourcecode Student Management System Login Page login.php sql injection (medium 6.9)
- [CVE-2024-6190](https://insights.sbomify.com/CVE-2024-6190/): itsourcecode Farm Management System Login index.php sql injection (medium 6.9)
- [CVE-2024-6189](https://insights.sbomify.com/CVE-2024-6189/): Tenda A301 WifiExtraSet fromSetWirelessRepeat stack-based overflow (high 8.7)
- [CVE-2024-6188](https://insights.sbomify.com/CVE-2024-6188/): Parsec Automation TrackSYS pagedefinition direct request (medium 6.9)
- [CVE-2024-6187](https://insights.sbomify.com/CVE-2024-6187/): Ruijie RG-UAC sub_commit.php os command injection (medium 5.3)
- [CVE-2024-6186](https://insights.sbomify.com/CVE-2024-6186/): Ruijie RG-UAC commit.php os command injection (medium 5.3)
- [CVE-2024-6185](https://insights.sbomify.com/CVE-2024-6185/): Ruijie RG-UAC commit.php get_ip_addr_details os command injection (medium 5.3)
- [CVE-2024-6184](https://insights.sbomify.com/CVE-2024-6184/): Ruijie RG-UAC reboot_commit.php os command injection (medium 5.3)
- [CVE-2024-6183](https://insights.sbomify.com/CVE-2024-6183/): EZ-Suite EZ-Partner Forgot Password cross site scripting (medium 6.9)
- [CVE-2024-6182](https://insights.sbomify.com/CVE-2024-6182/): LabVantage LIMS cross site scripting (medium 5.3)
- [CVE-2024-6181](https://insights.sbomify.com/CVE-2024-6181/): LabVantage LIMS cross site scripting (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/171/