# Vulnerabilities published in 2024


- [CVE-2024-5098](https://insights.sbomify.com/CVE-2024-5098/): SourceCodester Simple Inventory System login.php sql injection (medium 5.1)
- [CVE-2024-50972](https://insights.sbomify.com/CVE-2024-50972/): SQL injection in angeljudesuarez:construction management system (medium 6.5)
- [CVE-2024-50971](https://insights.sbomify.com/CVE-2024-50971/): SQL injection in angeljudesuarez:construction management system (medium 6.5)
- [CVE-2024-50970](https://insights.sbomify.com/CVE-2024-50970/): SQL injection in nikoarroyocuraza:online furniture shopping project (medium 6.5)
- [CVE-2024-5097](https://insights.sbomify.com/CVE-2024-5097/): SourceCodester Simple Inventory System tableedit.php#page=editprice cross-site request forgery (medium 6.9)
- [CVE-2024-50969](https://insights.sbomify.com/CVE-2024-50969/): Cross-site scripting in anisha:jonnys liquor (medium 6.1)
- [CVE-2024-50968](https://insights.sbomify.com/CVE-2024-50968/): Business logic in adonesevangelista:agri-trading online shopping system (high 7.5)
- [CVE-2024-50967](https://insights.sbomify.com/CVE-2024-50967/): The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. (medium 6.5)
- [CVE-2024-50966](https://insights.sbomify.com/CVE-2024-50966/): Cross-site request forgery in timgreen:dingfanzu cms (critical 9.3)
- [CVE-2024-50965](https://insights.sbomify.com/CVE-2024-50965/): Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arb (medium 5.4)
- [CVE-2024-50960](https://insights.sbomify.com/CVE-2024-50960/): Command injection in extron:sme 211 firmware (high 7.2)
- [CVE-2024-5096](https://insights.sbomify.com/CVE-2024-5096/): Hipcam Device MAC Address wifi.mac information disclosure (medium 6.9)
- [CVE-2024-50956](https://insights.sbomify.com/CVE-2024-50956/): A buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0, HCPLC_AM402-CPU1608TPTN 41.38.0.0, and HCPLC (medium 6.5)
- [CVE-2024-50955](https://insights.sbomify.com/CVE-2024-50955/): An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a crafted TCP message. (high 7.5)
- [CVE-2024-50954](https://insights.sbomify.com/CVE-2024-50954/): The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. (high 7.5)
- [CVE-2024-50953](https://insights.sbomify.com/CVE-2024-50953/): An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message. (high 7.5)
- [CVE-2024-5095](https://insights.sbomify.com/CVE-2024-5095/): Victor Zsviot Camera MQTT Packet denial of service (high 7.1)
- [CVE-2024-50948](https://insights.sbomify.com/CVE-2024-50948/): mochiMQTT v2.6.3 is vulnerable to Denial of Service (DoS) due to improper resource management. (high 7.5)
- [CVE-2024-50947](https://insights.sbomify.com/CVE-2024-50947/): Denial of service in davidepianca98:kmqtt (high 7.5)
- [CVE-2024-50945](https://insights.sbomify.com/CVE-2024-50945/): An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submi (high 7.5)
- [CVE-2024-50944](https://insights.sbomify.com/CVE-2024-50944/): Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. (critical 9.8)
- [CVE-2024-50942](https://insights.sbomify.com/CVE-2024-50942/): qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml. (critical 9.8)
- [CVE-2024-5094](https://insights.sbomify.com/CVE-2024-5094/): SourceCodester Best House Rental Management System view_payment.php sql injection (medium 6.9)
- [CVE-2024-50931](https://insights.sbomify.com/CVE-2024-50931/): Misconfiguration in silabs:z-wave software development kit (medium 4.6)
- [CVE-2024-50930](https://insights.sbomify.com/CVE-2024-50930/): Other in silabs:z-wave software development kit (high 8.8)
- [CVE-2024-5093](https://insights.sbomify.com/CVE-2024-5093/): SourceCodester Best House Rental Management System login.php sql injection (medium 6.9)
- [CVE-2024-50929](https://insights.sbomify.com/CVE-2024-50929/): Missing authorization in silabs:z-wave software development kit (medium 6.2)
- [CVE-2024-50928](https://insights.sbomify.com/CVE-2024-50928/): Missing authorization in silabs:z-wave software development kit (medium 6.5)
- [CVE-2024-50924](https://insights.sbomify.com/CVE-2024-50924/): Denial of service in silabs:z-wave software development kit (medium 6.5)
- [CVE-2024-50921](https://insights.sbomify.com/CVE-2024-50921/): Denial of service in silabs:z-wave software development kit (medium 6.5)
- [CVE-2024-50920](https://insights.sbomify.com/CVE-2024-50920/): Auth bypass in silabs:z-wave software development kit (high 8.8)
- [CVE-2024-5092](https://insights.sbomify.com/CVE-2024-5092/): Cross-site scripting in Elegant Addons for elementor (medium 6.4)
- [CVE-2024-50919](https://insights.sbomify.com/CVE-2024-50919/): File upload in jpress:jpress (critical 9.8)
- [CVE-2024-5091](https://insights.sbomify.com/CVE-2024-5091/): Cross-site scripting in SKT Addons for Elementor (high 7.4)
- [CVE-2024-5090](https://insights.sbomify.com/CVE-2024-5090/): Cross-site scripting in SiteOrigin Widgets Bundle (medium 6.4)
- [CVE-2024-5088](https://insights.sbomify.com/CVE-2024-5088/): Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5087](https://insights.sbomify.com/CVE-2024-5087/): Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change (medium 6.3)
- [CVE-2024-50861](https://insights.sbomify.com/CVE-2024-50861/): Cross-site scripting in gestioip:gestioip (medium 6.1)
- [CVE-2024-5086](https://insights.sbomify.com/CVE-2024-5086/): Cross-site scripting in Essential Addons for Elementor Pro (medium 6.4)
- [CVE-2024-50859](https://insights.sbomify.com/CVE-2024-50859/): Cross-site scripting in gestioip:gestioip (medium 4.8)
- [CVE-2024-50858](https://insights.sbomify.com/CVE-2024-50858/): Cross-site request forgery in gestioip:gestioip (high 8.8)
- [CVE-2024-50857](https://insights.sbomify.com/CVE-2024-50857/): Cross-site scripting in gestioip:gestioip (medium 4.8)
- [CVE-2024-50854](https://insights.sbomify.com/CVE-2024-50854/): Memory corruption in tendacn:g3 firmware (high 8.8)
- [CVE-2024-50853](https://insights.sbomify.com/CVE-2024-50853/): Command injection in tendacn:g3 firmware (high 8.8)
- [CVE-2024-50852](https://insights.sbomify.com/CVE-2024-50852/): Command injection in tendacn:g3 firmware (high 8.8)
- [CVE-2024-5085](https://insights.sbomify.com/CVE-2024-5085/): Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2024-50849](https://insights.sbomify.com/CVE-2024-50849/): Cross-site scripting in rws:worldserver (medium 4.8)
- [CVE-2024-50848](https://insights.sbomify.com/CVE-2024-50848/): XML external entity in rws:worldserver (medium 6.5)
- [CVE-2024-50843](https://insights.sbomify.com/CVE-2024-50843/): Information disclosure in phpgurukul:user registration \& login and user management system (medium 5.3)
- [CVE-2024-50842](https://insights.sbomify.com/CVE-2024-50842/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-50841](https://insights.sbomify.com/CVE-2024-50841/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-50840](https://insights.sbomify.com/CVE-2024-50840/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-5084](https://insights.sbomify.com/CVE-2024-5084/): Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution (critical 9.8)
- [CVE-2024-50839](https://insights.sbomify.com/CVE-2024-50839/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-50838](https://insights.sbomify.com/CVE-2024-50838/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-50837](https://insights.sbomify.com/CVE-2024-50837/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-50836](https://insights.sbomify.com/CVE-2024-50836/): Cross-site scripting in lopalopa:e-learning management system (medium 6.1)
- [CVE-2024-50835](https://insights.sbomify.com/CVE-2024-50835/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50834](https://insights.sbomify.com/CVE-2024-50834/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50833](https://insights.sbomify.com/CVE-2024-50833/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50832](https://insights.sbomify.com/CVE-2024-50832/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50831](https://insights.sbomify.com/CVE-2024-50831/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50830](https://insights.sbomify.com/CVE-2024-50830/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-5083](https://insights.sbomify.com/CVE-2024-5083/): Nexus Repository 2 - Stored XSS (medium 5.1)
- [CVE-2024-50829](https://insights.sbomify.com/CVE-2024-50829/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50828](https://insights.sbomify.com/CVE-2024-50828/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50827](https://insights.sbomify.com/CVE-2024-50827/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50826](https://insights.sbomify.com/CVE-2024-50826/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50825](https://insights.sbomify.com/CVE-2024-50825/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50824](https://insights.sbomify.com/CVE-2024-50824/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-50823](https://insights.sbomify.com/CVE-2024-50823/): SQL injection in lopalopa:e-learning management system (low 3.5)
- [CVE-2024-5082](https://insights.sbomify.com/CVE-2024-5082/): Nexus Repository 2 - Remote Code Execution (high 7.1)
- [CVE-2024-50811](https://insights.sbomify.com/CVE-2024-50811/): hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd (critical 9.1)
- [CVE-2024-50810](https://insights.sbomify.com/CVE-2024-50810/): hopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function. (medium 5.4)
- [CVE-2024-5081](https://insights.sbomify.com/CVE-2024-5081/): WP eMember <= v10.7.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-50809](https://insights.sbomify.com/CVE-2024-50809/): The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands (high 8.8)
- [CVE-2024-50808](https://insights.sbomify.com/CVE-2024-50808/): Code injection in seacms:seacms (high 8.8)
- [CVE-2024-50807](https://insights.sbomify.com/CVE-2024-50807/): Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. (medium 6.1)
- [CVE-2024-50804](https://insights.sbomify.com/CVE-2024-50804/): Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via (high 7.8)
- [CVE-2024-50803](https://insights.sbomify.com/CVE-2024-50803/): Redaxo Core CMS Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2024-50802](https://insights.sbomify.com/CVE-2024-50802/): SQL injection in abantecart:abantecart (medium 6.0)
- [CVE-2024-50801](https://insights.sbomify.com/CVE-2024-50801/): SQL injection in abantecart:abantecart (medium 6.0)
- [CVE-2024-50800](https://insights.sbomify.com/CVE-2024-50800/): Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error (medium 6.1)
- [CVE-2024-5080](https://insights.sbomify.com/CVE-2024-5080/): WP eMember < 10.6.6 - Admin+ Arbitrary File Upload (high 8.8)
- [CVE-2024-5079](https://insights.sbomify.com/CVE-2024-5079/): WP eMember < 10.6.7 - Unauthenticated Stored XSS via Member Registration (medium 6.1)
- [CVE-2024-5077](https://insights.sbomify.com/CVE-2024-5077/): WP eMember < 10.6.6 - Stored XSS in Blacklist via CSRF (medium 6.8)
- [CVE-2024-50766](https://insights.sbomify.com/CVE-2024-50766/): SQL injection in oretnom23:survey application system (critical 9.8)
- [CVE-2024-5076](https://insights.sbomify.com/CVE-2024-5076/): WP eMember < 10.6.6 - Bulk Delete via CSRF (high 8.8)
- [CVE-2024-5075](https://insights.sbomify.com/CVE-2024-5075/): WP eMember < 10.6.6 - Reflected XSS (medium 5.9)
- [CVE-2024-5074](https://insights.sbomify.com/CVE-2024-5074/): WP eMember < 10.6.6 - Reflected XSS (medium 5.4)
- [CVE-2024-5073](https://insights.sbomify.com/CVE-2024-5073/): Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed (medium 6.4)
- [CVE-2024-50724](https://insights.sbomify.com/CVE-2024-50724/): KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp. (critical 9.8)
- [CVE-2024-5072](https://insights.sbomify.com/CVE-2024-5072/): Other in Server (medium 6.5)
- [CVE-2024-50717](https://insights.sbomify.com/CVE-2024-50717/): SQL injection in smarts-srl:smart agent (critical 9.8)
- [CVE-2024-50716](https://insights.sbomify.com/CVE-2024-50716/): SQL injection in smarts-srl:smart agent (critical 9.8)
- [CVE-2024-50715](https://insights.sbomify.com/CVE-2024-50715/): Command injection in smarts-srl:smart agent (high 7.5)
- [CVE-2024-50714](https://insights.sbomify.com/CVE-2024-50714/): A Server-Side Request Forgery (SSRF) in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via a cr (high 7.5)
- [CVE-2024-50713](https://insights.sbomify.com/CVE-2024-50713/): SQL injection in smarts-srl:smart agent (critical 9.8)
- [CVE-2024-5071](https://insights.sbomify.com/CVE-2024-5071/): Bookster <= 1.1.0 - Unauthenticated Appointment Status Update (medium 6.5)
- [CVE-2024-50707](https://insights.sbomify.com/CVE-2024-50707/): Code injection in uniguest:tripleplay (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/225/