# Vulnerabilities published in 2024


- [CVE-2024-51362](https://insights.sbomify.com/CVE-2024-51362/): The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed th (medium 6.5)
- [CVE-2024-51360](https://insights.sbomify.com/CVE-2024-51360/): Code injection in phpgurukul:hospital management system (critical 9.8)
- [CVE-2024-5136](https://insights.sbomify.com/CVE-2024-5136/): PHPGurukul Directory Management System search-directory.php. cross site scripting (medium 5.1)
- [CVE-2024-51358](https://insights.sbomify.com/CVE-2024-51358/): An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application. (critical 9.8)
- [CVE-2024-5135](https://insights.sbomify.com/CVE-2024-5135/): PHPGurukul Directory Management System index.php sql injection (medium 6.9)
- [CVE-2024-51348](https://insights.sbomify.com/CVE-2024-51348/): A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated a (high 8.8)
- [CVE-2024-51347](https://insights.sbomify.com/CVE-2024-51347/): A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. (high 7.2)
- [CVE-2024-51346](https://insights.sbomify.com/CVE-2024-51346/): An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme. (high 7.7)
- [CVE-2024-5134](https://insights.sbomify.com/CVE-2024-5134/): SourceCodester Electricity Consumption Monitoring Tool delete-bill.php sql injection (medium 5.3)
- [CVE-2024-51337](https://insights.sbomify.com/CVE-2024-51337/): Cross-site scripting in gibbonedu:gibbon (low 3.5)
- [CVE-2024-51330](https://insights.sbomify.com/CVE-2024-51330/): Code injection in ultimaker:ultimaker cura (medium 4.4)
- [CVE-2024-5133](https://insights.sbomify.com/CVE-2024-5133/): Account Takeover via Exposed Recovery Token in lunary-ai/lunary (critical 9.1)
- [CVE-2024-51329](https://insights.sbomify.com/CVE-2024-51329/): Other in idrsdev:agile-board (high 8.1)
- [CVE-2024-51328](https://insights.sbomify.com/CVE-2024-51328/): Cross-site scripting in projectworlds:travel management system (medium 6.1)
- [CVE-2024-51327](https://insights.sbomify.com/CVE-2024-51327/): SQL injection in projectworlds:travel management system (critical 9.8)
- [CVE-2024-51326](https://insights.sbomify.com/CVE-2024-51326/): SQL injection in projectworlds:travel management system (high 7.5)
- [CVE-2024-51324](https://insights.sbomify.com/CVE-2024-51324/): An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bri (low 3.8)
- [CVE-2024-51322](https://insights.sbomify.com/CVE-2024-51322/): Cross-site scripting in zucchetti:ad hoc infinity (medium 5.4)
- [CVE-2024-51321](https://insights.sbomify.com/CVE-2024-51321/): Open redirect in zucchetti:ad hoc infinity (high 7.6)
- [CVE-2024-51320](https://insights.sbomify.com/CVE-2024-51320/): Cross-site scripting in zucchetti:ad hoc infinity (medium 5.4)
- [CVE-2024-51319](https://insights.sbomify.com/CVE-2024-51319/): File upload in zucchetti:ad hoc infinity (high 7.3)
- [CVE-2024-51317](https://insights.sbomify.com/CVE-2024-51317/): Command injection in netsurf-browser:netsurf (medium 6.5)
- [CVE-2024-51316](https://insights.sbomify.com/CVE-2024-51316/): The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevNa (high 7.5)
- [CVE-2024-51315](https://insights.sbomify.com/CVE-2024-51315/): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName (critical 9.8)
- [CVE-2024-51314](https://insights.sbomify.com/CVE-2024-51314/): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg. (critical 9.8)
- [CVE-2024-51313](https://insights.sbomify.com/CVE-2024-51313/): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg. (critical 9.8)
- [CVE-2024-51312](https://insights.sbomify.com/CVE-2024-51312/): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg. (critical 9.8)
- [CVE-2024-51311](https://insights.sbomify.com/CVE-2024-51311/): The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList. (critical 9.8)
- [CVE-2024-5131](https://insights.sbomify.com/CVE-2024-5131/): Improper Access Control in lunary-ai/lunary (high 7.5)
- [CVE-2024-51304](https://insights.sbomify.com/CVE-2024-51304/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-51301](https://insights.sbomify.com/CVE-2024-51301/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-51300](https://insights.sbomify.com/CVE-2024-51300/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-5130](https://insights.sbomify.com/CVE-2024-5130/): Incorrect Authorization in lunary-ai/lunary (high 7.5)
- [CVE-2024-51299](https://insights.sbomify.com/CVE-2024-51299/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-51298](https://insights.sbomify.com/CVE-2024-51298/): Command injection in draytek:vigor3900 firmware (critical 9.8)
- [CVE-2024-51296](https://insights.sbomify.com/CVE-2024-51296/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-5129](https://insights.sbomify.com/CVE-2024-5129/): Privilege Escalation Vulnerability in lunary-ai/lunary (high 8.2)
- [CVE-2024-5128](https://insights.sbomify.com/CVE-2024-5128/): IDOR Vulnerability in lunary-ai/lunary (critical 9.4)
- [CVE-2024-5127](https://insights.sbomify.com/CVE-2024-5127/): Improper Access Control in lunary-ai/lunary (medium 5.4)
- [CVE-2024-51260](https://insights.sbomify.com/CVE-2024-51260/): Command injection in draytek:vigor3900 firmware (critical 9.8)
- [CVE-2024-5126](https://insights.sbomify.com/CVE-2024-5126/): Improper Access Control in lunary-ai/lunary (high 7.6)
- [CVE-2024-51259](https://insights.sbomify.com/CVE-2024-51259/): Command injection in draytek:vigor3900 firmware (critical 9.8)
- [CVE-2024-51258](https://insights.sbomify.com/CVE-2024-51258/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-51257](https://insights.sbomify.com/CVE-2024-51257/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-51255](https://insights.sbomify.com/CVE-2024-51255/): Command injection in draytek:vigor3900 firmware (critical 9.8)
- [CVE-2024-51254](https://insights.sbomify.com/CVE-2024-51254/): Command injection in draytek:vigor3900 firmware (high 8.8)
- [CVE-2024-51253](https://insights.sbomify.com/CVE-2024-51253/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51252](https://insights.sbomify.com/CVE-2024-51252/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51251](https://insights.sbomify.com/CVE-2024-51251/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-5125](https://insights.sbomify.com/CVE-2024-5125/): XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui (high 7.3)
- [CVE-2024-51249](https://insights.sbomify.com/CVE-2024-51249/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51248](https://insights.sbomify.com/CVE-2024-51248/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51247](https://insights.sbomify.com/CVE-2024-51247/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51246](https://insights.sbomify.com/CVE-2024-51246/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51245](https://insights.sbomify.com/CVE-2024-51245/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51244](https://insights.sbomify.com/CVE-2024-51244/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-51243](https://insights.sbomify.com/CVE-2024-51243/): Code injection in eladmin:eladmin (high 7.2)
- [CVE-2024-51242](https://insights.sbomify.com/CVE-2024-51242/): Server-side request forgery in eladmin:eladmin (medium 6.5)
- [CVE-2024-51240](https://insights.sbomify.com/CVE-2024-51240/): An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, (high 8.0)
- [CVE-2024-5124](https://insights.sbomify.com/CVE-2024-5124/): Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-5123](https://insights.sbomify.com/CVE-2024-5123/): SourceCodester Event Registration System cross site scripting (medium 6.9)
- [CVE-2024-51229](https://insights.sbomify.com/CVE-2024-51229/): Cross-site scripting in pb-cms project:pb-cms (high 8.8)
- [CVE-2024-51228](https://insights.sbomify.com/CVE-2024-51228/): An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1 (medium 6.8)
- [CVE-2024-51226](https://insights.sbomify.com/CVE-2024-51226/): Cross-site scripting in phpgurukul:vehicle record management system (medium 6.1)
- [CVE-2024-51225](https://insights.sbomify.com/CVE-2024-51225/): Cross-site scripting in phpgurukul:vehicle record management system (medium 4.8)
- [CVE-2024-51224](https://insights.sbomify.com/CVE-2024-51224/): Cross-site scripting in phpgurukul:vehicle record management system (medium 4.8)
- [CVE-2024-51223](https://insights.sbomify.com/CVE-2024-51223/): Cross-site scripting in phpgurukul:vehicle record management system (medium 4.8)
- [CVE-2024-51222](https://insights.sbomify.com/CVE-2024-51222/): Cross-site scripting in phpgurukul:vehicle record management system (medium 4.8)
- [CVE-2024-5122](https://insights.sbomify.com/CVE-2024-5122/): SourceCodester Event Registration System sql injection (medium 6.9)
- [CVE-2024-51213](https://insights.sbomify.com/CVE-2024-51213/): Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component. (medium 6.1)
- [CVE-2024-51211](https://insights.sbomify.com/CVE-2024-51211/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2024-51210](https://insights.sbomify.com/CVE-2024-51210/): Firepad allows insecure document access (medium 5.3)
- [CVE-2024-5121](https://insights.sbomify.com/CVE-2024-5121/): SourceCodester Event Registration System cross site scripting (medium 5.3)
- [CVE-2024-51209](https://insights.sbomify.com/CVE-2024-51209/): Cross-site scripting in phpgurukul:client management system (medium 6.1)
- [CVE-2024-51208](https://insights.sbomify.com/CVE-2024-51208/): File upload in phpgurukul:boat booking system (high 7.2)
- [CVE-2024-5120](https://insights.sbomify.com/CVE-2024-5120/): SourceCodester Event Registration System sql injection (medium 5.3)
- [CVE-2024-51190](https://insights.sbomify.com/CVE-2024-51190/): Cross-site scripting in trendnet:tew-651br firmware (medium 4.8)
- [CVE-2024-5119](https://insights.sbomify.com/CVE-2024-5119/): SourceCodester Event Registration System sql injection (medium 5.3)
- [CVE-2024-51189](https://insights.sbomify.com/CVE-2024-51189/): Cross-site scripting in trendnet:tew-651br firmware (medium 4.8)
- [CVE-2024-51188](https://insights.sbomify.com/CVE-2024-51188/): Cross-site scripting in trendnet:tew-651br firmware (medium 4.8)
- [CVE-2024-51187](https://insights.sbomify.com/CVE-2024-51187/): Cross-site scripting in trendnet:tew-651br firmware (medium 4.8)
- [CVE-2024-51186](https://insights.sbomify.com/CVE-2024-51186/): Command injection in dlink:dir-820l firmware (high 8.0)
- [CVE-2024-51182](https://insights.sbomify.com/CVE-2024-51182/): Cross-site scripting in celk:celk saude (medium 6.1)
- [CVE-2024-51181](https://insights.sbomify.com/CVE-2024-51181/): Cross-site scripting in phpgurukul:ifsc code finder (high 8.8)
- [CVE-2024-51180](https://insights.sbomify.com/CVE-2024-51180/): Cross-site scripting in phpgurukul:ifsc code finder (high 8.8)
- [CVE-2024-5118](https://insights.sbomify.com/CVE-2024-5118/): SourceCodester Event Registration System login.php sql injection (medium 6.9)
- [CVE-2024-51179](https://insights.sbomify.com/CVE-2024-51179/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-51175](https://insights.sbomify.com/CVE-2024-51175/): An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component. (high 7.5)
- [CVE-2024-5117](https://insights.sbomify.com/CVE-2024-5117/): SourceCodester Event Registration System portal.php sql injection (medium 6.9)
- [CVE-2024-51165](https://insights.sbomify.com/CVE-2024-51165/): SQL injection in ketr:jepaas (high 7.5)
- [CVE-2024-51164](https://insights.sbomify.com/CVE-2024-51164/): SQL injection in ketr:jepaas (critical 9.1)
- [CVE-2024-51163](https://insights.sbomify.com/CVE-2024-51163/): A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive (high 7.5)
- [CVE-2024-51162](https://insights.sbomify.com/CVE-2024-51162/): An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. (high 8.8)
- [CVE-2024-5116](https://insights.sbomify.com/CVE-2024-5116/): SourceCodester Online Examination System save.php sql injection (medium 6.9)
- [CVE-2024-51157](https://insights.sbomify.com/CVE-2024-51157/): Cross-site request forgery in 07fly:07flycms (medium 4.7)
- [CVE-2024-51156](https://insights.sbomify.com/CVE-2024-51156/): Cross-site request forgery in 07fly:07flycms (medium 4.7)
- [CVE-2024-51152](https://insights.sbomify.com/CVE-2024-51152/): File upload in alexstack:laravel cms (high 7.2)
- [CVE-2024-51151](https://insights.sbomify.com/CVE-2024-51151/): Command injection in dlink:di-8200 firmware (high 8.0)
- [CVE-2024-5115](https://insights.sbomify.com/CVE-2024-5115/): Campcodes Complete Web-Based School Management System teacher_profile.php sql injection (medium 5.3)
- [CVE-2024-51144](https://insights.sbomify.com/CVE-2024-51144/): Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.ser (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/223/