# Vulnerabilities published in 2024


- [CVE-2024-51142](https://insights.sbomify.com/CVE-2024-51142/): Cross-site scripting in chamilo:chamilo lms (medium 6.1)
- [CVE-2024-51141](https://insights.sbomify.com/CVE-2024-51141/): Code injection in totolink:a6000ub firmware (high 7.8)
- [CVE-2024-5114](https://insights.sbomify.com/CVE-2024-5114/): Campcodes Complete Web-Based School Management System teacher_attendance_history1.php sql injection (medium 5.3)
- [CVE-2024-51139](https://insights.sbomify.com/CVE-2024-51139/): Memory corruption in draytek:vigor1000b firmware (critical 9.8)
- [CVE-2024-51138](https://insights.sbomify.com/CVE-2024-51138/): Memory corruption in draytek:vigor1000b firmware (critical 9.8)
- [CVE-2024-51136](https://insights.sbomify.com/CVE-2024-51136/): XML external entity in openimaj:openimaj (critical 9.8)
- [CVE-2024-51135](https://insights.sbomify.com/CVE-2024-51135/): powertac-server XML External Entity vulnerability (critical 9.8)
- [CVE-2024-51132](https://insights.sbomify.com/CVE-2024-51132/): HAPI FHIR XML External Entity (XXE) vulnerability (critical 9.8)
- [CVE-2024-5113](https://insights.sbomify.com/CVE-2024-5113/): Campcodes Complete Web-Based School Management System student_profile1.php sql injection (medium 5.3)
- [CVE-2024-51127](https://insights.sbomify.com/CVE-2024-51127/): hornetq vulnerable to file overwrite, sensitive information disclosure (critical 9.1)
- [CVE-2024-51123](https://insights.sbomify.com/CVE-2024-51123/): An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via (high 7.5)
- [CVE-2024-51122](https://insights.sbomify.com/CVE-2024-51122/): Cross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arb (medium 6.1)
- [CVE-2024-5112](https://insights.sbomify.com/CVE-2024-5112/): Campcodes Complete Web-Based School Management System student_profile.php sql injection (medium 5.3)
- [CVE-2024-51116](https://insights.sbomify.com/CVE-2024-51116/): Memory corruption in tenda:ac6 firmware (high 8.8)
- [CVE-2024-51115](https://insights.sbomify.com/CVE-2024-51115/): Command injection in dcnetworks:dcme-320 firmware (critical 9.8)
- [CVE-2024-51114](https://insights.sbomify.com/CVE-2024-51114/): An issue in Beijing Digital China Yunke Information Technology Co.Ltd v.7.2.6.120 allows a remote attacker to execute arbitrary code via the (high 8.8)
- [CVE-2024-51112](https://insights.sbomify.com/CVE-2024-51112/): Open redirect in pnetlab:pnetlab (medium 6.1)
- [CVE-2024-51111](https://insights.sbomify.com/CVE-2024-51111/): Cross-site scripting in pnetlab:pnetlab (medium 4.1)
- [CVE-2024-5111](https://insights.sbomify.com/CVE-2024-5111/): Campcodes Complete Web-Based School Management System student_payment_invoice1.php sql injection (medium 5.3)
- [CVE-2024-51108](https://insights.sbomify.com/CVE-2024-51108/): Cross-site scripting in anujk305:medical card generation system (medium 5.4)
- [CVE-2024-51107](https://insights.sbomify.com/CVE-2024-51107/): Cross-site scripting in anujk305:medical card generation system (medium 4.8)
- [CVE-2024-51106](https://insights.sbomify.com/CVE-2024-51106/): Cross-site scripting in anujk305:medical card generation system (medium 4.6)
- [CVE-2024-51103](https://insights.sbomify.com/CVE-2024-51103/): SQL injection in phpgurukul:student management system (medium 6.5)
- [CVE-2024-51102](https://insights.sbomify.com/CVE-2024-51102/): SQL injection in phpgurukul:student management system (medium 4.4)
- [CVE-2024-51101](https://insights.sbomify.com/CVE-2024-51101/): SQL injection in phpgurukul:restaurant table booking system (critical 9.8)
- [CVE-2024-5110](https://insights.sbomify.com/CVE-2024-5110/): Campcodes Complete Web-Based School Management System student_payment_invoice.php sql injection (medium 5.3)
- [CVE-2024-51099](https://insights.sbomify.com/CVE-2024-51099/): Cross-site scripting in phpgurukul:medical card generation system (medium 6.1)
- [CVE-2024-51094](https://insights.sbomify.com/CVE-2024-51094/): Code injection in snipeitapp:snipe-it (high 8.0)
- [CVE-2024-51093](https://insights.sbomify.com/CVE-2024-51093/): Cross Site Scripting vulnerability in Snipe-IT (high 8.7)
- [CVE-2024-51092](https://insights.sbomify.com/CVE-2024-51092/): LibreNMS has an Authenticated OS Command Injection (critical 9.1)
- [CVE-2024-51091](https://insights.sbomify.com/CVE-2024-51091/): seajs Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2024-5109](https://insights.sbomify.com/CVE-2024-5109/): Campcodes Complete Web-Based School Management System student_payment_history.php sql injection (medium 5.3)
- [CVE-2024-5108](https://insights.sbomify.com/CVE-2024-5108/): Campcodes Complete Web-Based School Management System student_payment_details4.php sql injection (medium 5.3)
- [CVE-2024-51076](https://insights.sbomify.com/CVE-2024-51076/): Cross-site scripting in phpgurukul:online dj booking management system (medium 6.1)
- [CVE-2024-51075](https://insights.sbomify.com/CVE-2024-51075/): Cross-site scripting in phpgurukul:online dj booking management system (medium 6.1)
- [CVE-2024-51074](https://insights.sbomify.com/CVE-2024-51074/): Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odo (medium 6.7)
- [CVE-2024-51073](https://insights.sbomify.com/CVE-2024-51073/): An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication b (medium 6.7)
- [CVE-2024-51072](https://insights.sbomify.com/CVE-2024-51072/): An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service. (medium 5.3)
- [CVE-2024-5107](https://insights.sbomify.com/CVE-2024-5107/): Campcodes Complete Web-Based School Management System student_payment_details2.php sql injection (medium 5.3)
- [CVE-2024-51066](https://insights.sbomify.com/CVE-2024-51066/): Missing authorization in phpgurukul:beauty parlour management system (high 7.5)
- [CVE-2024-51065](https://insights.sbomify.com/CVE-2024-51065/): SQL injection in phpgurukul:beauty parlour management system (critical 9.8)
- [CVE-2024-51064](https://insights.sbomify.com/CVE-2024-51064/): SQL injection in phpgurukul:teachers record management system (critical 9.8)
- [CVE-2024-51063](https://insights.sbomify.com/CVE-2024-51063/): SQL injection in phpgurukul:teachers record management system (critical 9.1)
- [CVE-2024-51060](https://insights.sbomify.com/CVE-2024-51060/): SQL injection in projectworlds:online admission system (critical 9.1)
- [CVE-2024-5106](https://insights.sbomify.com/CVE-2024-5106/): Campcodes Complete Web-Based School Management System student_payment_details3.php sql injection (medium 5.3)
- [CVE-2024-51058](https://insights.sbomify.com/CVE-2024-51058/): TCPDF Local File Inclusion vulnerability (medium 6.2)
- [CVE-2024-51055](https://insights.sbomify.com/CVE-2024-51055/): Cross-site scripting in hoosk:hoosk (medium 6.5)
- [CVE-2024-51054](https://insights.sbomify.com/CVE-2024-51054/): Cross-site scripting in phpgurukul:online marriage registration system (medium 4.8)
- [CVE-2024-51053](https://insights.sbomify.com/CVE-2024-51053/): An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via (critical 9.8)
- [CVE-2024-51051](https://insights.sbomify.com/CVE-2024-51051/): AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account. (critical 9.8)
- [CVE-2024-5105](https://insights.sbomify.com/CVE-2024-5105/): Campcodes Complete Web-Based School Management System student_payment_details.php sql injection (medium 5.3)
- [CVE-2024-5104](https://insights.sbomify.com/CVE-2024-5104/): Campcodes Complete Web-Based School Management System student_grade_wise.php sql injection (medium 5.3)
- [CVE-2024-51037](https://insights.sbomify.com/CVE-2024-51037/): Information disclosure in kodcloud:kodbox (medium 5.3)
- [CVE-2024-51032](https://insights.sbomify.com/CVE-2024-51032/): Cross-site scripting in oretnom23:toll tax management system (medium 5.4)
- [CVE-2024-51031](https://insights.sbomify.com/CVE-2024-51031/): Cross-site scripting in oretnom23:cab management system (medium 5.4)
- [CVE-2024-51030](https://insights.sbomify.com/CVE-2024-51030/): SQL injection in oretnom23:cab management system (medium 6.5)
- [CVE-2024-5103](https://insights.sbomify.com/CVE-2024-5103/): Campcodes Complete Web-Based School Management System student_first_payment.php sql injection (medium 5.3)
- [CVE-2024-51027](https://insights.sbomify.com/CVE-2024-51027/): Ruijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter. (medium 6.5)
- [CVE-2024-51026](https://insights.sbomify.com/CVE-2024-51026/): The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is po (medium 5.4)
- [CVE-2024-51024](https://insights.sbomify.com/CVE-2024-51024/): Command injection in dlink:dir-823g firmware (high 8.0)
- [CVE-2024-51023](https://insights.sbomify.com/CVE-2024-51023/): Command injection in dlink:dir-823g firmware (high 8.8)
- [CVE-2024-51022](https://insights.sbomify.com/CVE-2024-51022/): Memory corruption in netgear:xr300 firmware (medium 5.7)
- [CVE-2024-51021](https://insights.sbomify.com/CVE-2024-51021/): Command injection in netgear:r6400v2 firmware (high 8.0)
- [CVE-2024-51020](https://insights.sbomify.com/CVE-2024-51020/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-5102](https://insights.sbomify.com/CVE-2024-5102/): Elevation of Privelage via symlinked file in Avast Antivirus (high 7.3)
- [CVE-2024-51019](https://insights.sbomify.com/CVE-2024-51019/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-51018](https://insights.sbomify.com/CVE-2024-51018/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-51017](https://insights.sbomify.com/CVE-2024-51017/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-51016](https://insights.sbomify.com/CVE-2024-51016/): Memory corruption in netgear:xr300 firmware (medium 5.7)
- [CVE-2024-51015](https://insights.sbomify.com/CVE-2024-51015/): Command injection in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-51014](https://insights.sbomify.com/CVE-2024-51014/): Memory corruption in netgear:xr300 firmware (medium 5.7)
- [CVE-2024-51013](https://insights.sbomify.com/CVE-2024-51013/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-51012](https://insights.sbomify.com/CVE-2024-51012/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-51011](https://insights.sbomify.com/CVE-2024-51011/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-51010](https://insights.sbomify.com/CVE-2024-51010/): Command injection in netgear:r6400v2 firmware (high 8.0)
- [CVE-2024-5101](https://insights.sbomify.com/CVE-2024-5101/): SourceCodester Simple Inventory System updateproduct.php sql injection (medium 5.3)
- [CVE-2024-51009](https://insights.sbomify.com/CVE-2024-51009/): Command injection in netgear:r8500 firmware (high 8.0)
- [CVE-2024-51008](https://insights.sbomify.com/CVE-2024-51008/): Command injection in netgear:xr300 firmware (high 8.0)
- [CVE-2024-51007](https://insights.sbomify.com/CVE-2024-51007/): Memory corruption in netgear:xr300 firmware (medium 5.7)
- [CVE-2024-51006](https://insights.sbomify.com/CVE-2024-51006/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-51005](https://insights.sbomify.com/CVE-2024-51005/): Command injection in netgear:r8500 firmware (high 8.0)
- [CVE-2024-51004](https://insights.sbomify.com/CVE-2024-51004/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-51003](https://insights.sbomify.com/CVE-2024-51003/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-51002](https://insights.sbomify.com/CVE-2024-51002/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-51001](https://insights.sbomify.com/CVE-2024-51001/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-51000](https://insights.sbomify.com/CVE-2024-51000/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-5100](https://insights.sbomify.com/CVE-2024-5100/): SourceCodester Simple Inventory System tableedit.php sql injection (medium 5.3)
- [CVE-2024-50999](https://insights.sbomify.com/CVE-2024-50999/): Command injection in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-50998](https://insights.sbomify.com/CVE-2024-50998/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-50997](https://insights.sbomify.com/CVE-2024-50997/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-50996](https://insights.sbomify.com/CVE-2024-50996/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-50995](https://insights.sbomify.com/CVE-2024-50995/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-50994](https://insights.sbomify.com/CVE-2024-50994/): Memory corruption in netgear:r8500 firmware (medium 5.7)
- [CVE-2024-50993](https://insights.sbomify.com/CVE-2024-50993/): Command injection in netgear:r8500 firmware (high 8.0)
- [CVE-2024-50991](https://insights.sbomify.com/CVE-2024-50991/): Cross-site scripting in phpgurukul:user management system (medium 4.8)
- [CVE-2024-50990](https://insights.sbomify.com/CVE-2024-50990/): Cross-site scripting in phpgurukul:online marriage registration system (medium 6.1)
- [CVE-2024-5099](https://insights.sbomify.com/CVE-2024-5099/): SourceCodester Simple Inventory System updateprice.php sql injection (medium 5.3)
- [CVE-2024-50989](https://insights.sbomify.com/CVE-2024-50989/): SQL injection in phpgurukul:online marriage registration system (critical 9.8)
- [CVE-2024-50986](https://insights.sbomify.com/CVE-2024-50986/): Code injection in clementine-player:clementine (high 7.3)
- [CVE-2024-50983](https://insights.sbomify.com/CVE-2024-50983/): Cross-site scripting in getflightpath:flightpath (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/224/