# Vulnerabilities published in 2024


- [CVE-2024-54462](https://insights.sbomify.com/CVE-2024-54462/): Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites (low 2.1)
- [CVE-2024-54461](https://insights.sbomify.com/CVE-2024-54461/): Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites (low 2.1)
- [CVE-2024-54460](https://insights.sbomify.com/CVE-2024-54460/): Bluetooth: iso: Fix circular lock in iso_listen_bis (medium 5.5)
- [CVE-2024-54458](https://insights.sbomify.com/CVE-2024-54458/): scsi: ufs: bsg: Set bsg_queue to NULL after removal (high 7.8)
- [CVE-2024-54457](https://insights.sbomify.com/CVE-2024-54457/): Security feature bypass in AE1021 (high 7.2)
- [CVE-2024-54456](https://insights.sbomify.com/CVE-2024-54456/): NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (high 7.8)
- [CVE-2024-54455](https://insights.sbomify.com/CVE-2024-54455/): accel/ivpu: Fix general protection fault in ivpu_bo_list() (medium 5.5)
- [CVE-2024-54454](https://insights.sbomify.com/CVE-2024-54454/): An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. (medium 5.3)
- [CVE-2024-54453](https://insights.sbomify.com/CVE-2024-54453/): An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. (high 7.5)
- [CVE-2024-54452](https://insights.sbomify.com/CVE-2024-54452/): An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. (medium 4.9)
- [CVE-2024-54451](https://insights.sbomify.com/CVE-2024-54451/): A cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7 (medium 4.8)
- [CVE-2024-54450](https://insights.sbomify.com/CVE-2024-54450/): An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. (critical 9.4)
- [CVE-2024-5445](https://insights.sbomify.com/CVE-2024-5445/): Ecosystem Agent Insufficient Transport Layer Security (low 3.8)
- [CVE-2024-54449](https://insights.sbomify.com/CVE-2024-54449/): Remote Code Execution (RCE) via Arbitrary File Write In Document API (high 8.7)
- [CVE-2024-54448](https://insights.sbomify.com/CVE-2024-54448/): Remote Code Execution (RCE) via Automation Scripting (high 8.6)
- [CVE-2024-54447](https://insights.sbomify.com/CVE-2024-54447/): Blind SQLi in Saved Search (high 7.1)
- [CVE-2024-54446](https://insights.sbomify.com/CVE-2024-54446/): Blind SQLi in Document History (high 7.1)
- [CVE-2024-54445](https://insights.sbomify.com/CVE-2024-54445/): Blind SQLi in Login (high 8.7)
- [CVE-2024-54444](https://insights.sbomify.com/CVE-2024-54444/): WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54443](https://insights.sbomify.com/CVE-2024-54443/): WordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54442](https://insights.sbomify.com/CVE-2024-54442/): WordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-54441](https://insights.sbomify.com/CVE-2024-54441/): WordPress Utech World Time Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54440](https://insights.sbomify.com/CVE-2024-54440/): WordPress WP-Ban-User plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5444](https://insights.sbomify.com/CVE-2024-5444/): Bible Text <= 0.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-54439](https://insights.sbomify.com/CVE-2024-54439/): WordPress Amazon Product Price plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54438](https://insights.sbomify.com/CVE-2024-54438/): WordPress Gaxx Keywords plugin <= 0.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54437](https://insights.sbomify.com/CVE-2024-54437/): WordPress jCarousel for WordPress plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54436](https://insights.sbomify.com/CVE-2024-54436/): WordPress Jet Footer Code plugin <= 1.4 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54435](https://insights.sbomify.com/CVE-2024-54435/): WordPress Onlywire Multi Autosubmitter plugin <= 1.2.4 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54434](https://insights.sbomify.com/CVE-2024-54434/): WordPress phZoom plugin <= 1.2.92 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54433](https://insights.sbomify.com/CVE-2024-54433/): WordPress Simple Booking – Widget plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54432](https://insights.sbomify.com/CVE-2024-54432/): WordPress WP Flipkart Importer plugin <= 1.4 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54431](https://insights.sbomify.com/CVE-2024-54431/): WordPress Admin Customization plugin <= 2.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54430](https://insights.sbomify.com/CVE-2024-54430/): WordPress EELV Newsletter plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-5443](https://insights.sbomify.com/CVE-2024-5443/): Remote Code Execution via Path Traversal in parisneo/lollms (critical 9.8)
- [CVE-2024-54429](https://insights.sbomify.com/CVE-2024-54429/): WordPress Aphorismus plugin <= 1.2.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54428](https://insights.sbomify.com/CVE-2024-54428/): WordPress Add image to Post plugin <= 0.6 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54427](https://insights.sbomify.com/CVE-2024-54427/): WordPress Category of Posts plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54426](https://insights.sbomify.com/CVE-2024-54426/): WordPress LeaderBoard Plugin plugin <= 1.2.4 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54425](https://insights.sbomify.com/CVE-2024-54425/): WordPress LionScripts: Site Maintenance plugin <= 2.1 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54424](https://insights.sbomify.com/CVE-2024-54424/): WordPress Like in Vk.com plugin <= 0.5.2 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54423](https://insights.sbomify.com/CVE-2024-54423/): WordPress Social Media Sharing plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54422](https://insights.sbomify.com/CVE-2024-54422/): WordPress Evernote Sync plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54421](https://insights.sbomify.com/CVE-2024-54421/): WordPress Floating Video Player plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54420](https://insights.sbomify.com/CVE-2024-54420/): WordPress Metrika plugin <= 1.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5442](https://insights.sbomify.com/CVE-2024-5442/): NextGEN Gallery < 3.59.3 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-54419](https://insights.sbomify.com/CVE-2024-54419/): WordPress Ui Slider Filter By Price plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-54418](https://insights.sbomify.com/CVE-2024-54418/): WordPress DTC Documents plugin <= 1.1.05 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-54417](https://insights.sbomify.com/CVE-2024-54417/): WordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-54416](https://insights.sbomify.com/CVE-2024-54416/): WordPress Wp Login with Ajax plugin <= 0.6 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54415](https://insights.sbomify.com/CVE-2024-54415/): WordPress WP-HideThat plugin <= 1.2 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54414](https://insights.sbomify.com/CVE-2024-54414/): WordPress Geoportail Shortcode plugin <= 2.4.4 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54413](https://insights.sbomify.com/CVE-2024-54413/): WordPress Display Future Posts plugin <= 0.2.3 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54412](https://insights.sbomify.com/CVE-2024-54412/): WordPress ECT Product Carousel plugin <= 1.9 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54411](https://insights.sbomify.com/CVE-2024-54411/): WordPress WP Controller plugin <= 3.2.0 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54410](https://insights.sbomify.com/CVE-2024-54410/): WordPress SOPA Blackout plugin <= 1.4 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5441](https://insights.sbomify.com/CVE-2024-5441/): Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-54409](https://insights.sbomify.com/CVE-2024-54409/): WordPress XPD Reduce Image Filesize plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54408](https://insights.sbomify.com/CVE-2024-54408/): WordPress Youtube Video Grid plugin <= 1.9 - CSRF to Settings Change vulnerability (medium 6.5)
- [CVE-2024-54407](https://insights.sbomify.com/CVE-2024-54407/): WordPress CK and SyntaxHighlighter plugin <= 3.4.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54406](https://insights.sbomify.com/CVE-2024-54406/): WordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54405](https://insights.sbomify.com/CVE-2024-54405/): WordPress ECT Social Share plugin <= 1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54404](https://insights.sbomify.com/CVE-2024-54404/): WordPress MDC Comment Toolbar plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54403](https://insights.sbomify.com/CVE-2024-54403/): WordPress Visual Recent Posts plugin <= 1.2.3 - Reflected Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2024-54402](https://insights.sbomify.com/CVE-2024-54402/): WordPress Arabic Webfonts plugin <= 1.4.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54401](https://insights.sbomify.com/CVE-2024-54401/): WordPress Advanced Fancybox plugin <= 1.1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54400](https://insights.sbomify.com/CVE-2024-54400/): WordPress AppMaps plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5440](https://insights.sbomify.com/CVE-2024-5440/): If-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSS (medium 5.4)
- [CVE-2024-54399](https://insights.sbomify.com/CVE-2024-54399/): WordPress CRUDLab Google Plus Button plugin <= 1.0.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54398](https://insights.sbomify.com/CVE-2024-54398/): WordPress Flaming Forms plugin <= 1.0.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54397](https://insights.sbomify.com/CVE-2024-54397/): WordPress Go Animate plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54396](https://insights.sbomify.com/CVE-2024-54396/): WordPress Bet sport Free plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-54395](https://insights.sbomify.com/CVE-2024-54395/): WordPress Increase Sociability plugin <= 1.3.0 - Reflected Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2024-54394](https://insights.sbomify.com/CVE-2024-54394/): WordPress Mandrill WP plugin <= 1.0.5 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54393](https://insights.sbomify.com/CVE-2024-54393/): WordPress WP Fiddle plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54392](https://insights.sbomify.com/CVE-2024-54392/): WordPress WP微信机器人 plugin <= 5.3.5 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54391](https://insights.sbomify.com/CVE-2024-54391/): WordPress WordPress Filter plugin <= 1.4.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54390](https://insights.sbomify.com/CVE-2024-54390/): WordPress TagGator plugin <= 1.54 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5439](https://insights.sbomify.com/CVE-2024-5439/): Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-54389](https://insights.sbomify.com/CVE-2024-54389/): WordPress addWeather plugin <= 2.5.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54388](https://insights.sbomify.com/CVE-2024-54388/): WordPress Multiple Admin Emails plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54387](https://insights.sbomify.com/CVE-2024-54387/): WordPress Posts Date Ranges plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54386](https://insights.sbomify.com/CVE-2024-54386/): WordPress Push Monkey Pro plugin <= 3.9 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54385](https://insights.sbomify.com/CVE-2024-54385/): WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2024-54384](https://insights.sbomify.com/CVE-2024-54384/): WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.8.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54383](https://insights.sbomify.com/CVE-2024-54383/): WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2024-54382](https://insights.sbomify.com/CVE-2024-54382/): WordPress Bold Page Builder plugin <= 5.1.5 - Path Traversal vulnerability (medium 4.9)
- [CVE-2024-54381](https://insights.sbomify.com/CVE-2024-54381/): WordPress Advance Menu Manager plugin <= 3.1.1 - Settings Change vulnerability (high 7.1)
- [CVE-2024-54380](https://insights.sbomify.com/CVE-2024-54380/): WordPress WP Cookies Enabler plugin <= 1.0.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-5438](https://insights.sbomify.com/CVE-2024-5438/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 4.3)
- [CVE-2024-54379](https://insights.sbomify.com/CVE-2024-54379/): WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-54378](https://insights.sbomify.com/CVE-2024-54378/): WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-54376](https://insights.sbomify.com/CVE-2024-54376/): WordPress EazyDocs plugin <= 2.8.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-54375](https://insights.sbomify.com/CVE-2024-54375/): WordPress Woolook plugin <= 1.7.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-54374](https://insights.sbomify.com/CVE-2024-54374/): WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-54373](https://insights.sbomify.com/CVE-2024-54373/): WordPress EduAdmin Booking plugin <= 5.2.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-54372](https://insights.sbomify.com/CVE-2024-54372/): WordPress Insertify plugin <= 1.1.4 - CSRF to Remote Code Execution vulnerability (critical 9.6)
- [CVE-2024-54370](https://insights.sbomify.com/CVE-2024-54370/): WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-5437](https://insights.sbomify.com/CVE-2024-5437/): SourceCodester Simple Online Bidding System save_category cross site scripting (medium 5.3)
- [CVE-2024-54369](https://insights.sbomify.com/CVE-2024-54369/): WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/198/