# Vulnerabilities published in 2024


- [CVE-2024-48461](https://insights.sbomify.com/CVE-2024-48461/): Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field. (medium 4.8)
- [CVE-2024-48460](https://insights.sbomify.com/CVE-2024-48460/): Eugeny Tabby Sends Password Despite Host Key Verification Failure (medium 4.3)
- [CVE-2024-4846](https://insights.sbomify.com/CVE-2024-4846/): Auth bypass in Server (medium 6.3)
- [CVE-2024-48459](https://insights.sbomify.com/CVE-2024-48459/): A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (high 7.3)
- [CVE-2024-48457](https://insights.sbomify.com/CVE-2024-48457/): An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 (high 7.5)
- [CVE-2024-48456](https://insights.sbomify.com/CVE-2024-48456/): An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 (high 7.5)
- [CVE-2024-48455](https://insights.sbomify.com/CVE-2024-48455/): An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 (low 2.7)
- [CVE-2024-48454](https://insights.sbomify.com/CVE-2024-48454/): File upload in oretnom23:purchase order management system (high 7.2)
- [CVE-2024-48453](https://insights.sbomify.com/CVE-2024-48453/): An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function (critical 9.8)
- [CVE-2024-48450](https://insights.sbomify.com/CVE-2024-48450/): An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group. (medium 6.5)
- [CVE-2024-4845](https://insights.sbomify.com/CVE-2024-4845/): Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] (high 8.8)
- [CVE-2024-48448](https://insights.sbomify.com/CVE-2024-48448/): An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML fil (medium 6.1)
- [CVE-2024-48445](https://insights.sbomify.com/CVE-2024-48445/): An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. (critical 9.8)
- [CVE-2024-48442](https://insights.sbomify.com/CVE-2024-48442/): Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows a (medium 6.5)
- [CVE-2024-48441](https://insights.sbomify.com/CVE-2024-48441/): Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection (high 8.8)
- [CVE-2024-48440](https://insights.sbomify.com/CVE-2024-48440/): Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command (high 8.8)
- [CVE-2024-4844](https://insights.sbomify.com/CVE-2024-4844/): Hardcoded credentials in ePolicy Orchestrator (high 7.5)
- [CVE-2024-4843](https://insights.sbomify.com/CVE-2024-4843/): Missing authorization in ePolicy Orchestrator (medium 4.3)
- [CVE-2024-48428](https://insights.sbomify.com/CVE-2024-48428/): Information disclosure in olivegroup:olivevle (critical 9.8)
- [CVE-2024-48427](https://insights.sbomify.com/CVE-2024-48427/): SQL injection in oretnom23:packers and movers management system (high 8.1)
- [CVE-2024-48426](https://insights.sbomify.com/CVE-2024-48426/): Memory corruption in assimp:assimp (medium 6.2)
- [CVE-2024-48425](https://insights.sbomify.com/CVE-2024-48425/): Null dereference in assimp:assimp (medium 5.5)
- [CVE-2024-48424](https://insights.sbomify.com/CVE-2024-48424/): Memory corruption in assimp:assimp (medium 5.5)
- [CVE-2024-48423](https://insights.sbomify.com/CVE-2024-48423/): Use after free in assimp:assimp (high 8.4)
- [CVE-2024-48420](https://insights.sbomify.com/CVE-2024-48420/): Memory corruption in edimax:br-6476ac firmware (high 8.8)
- [CVE-2024-48419](https://insights.sbomify.com/CVE-2024-48419/): Command injection in edimax:br-6476ac firmware (high 8.8)
- [CVE-2024-48418](https://insights.sbomify.com/CVE-2024-48418/): Command injection in edimax:br-6476ac firmware (high 8.8)
- [CVE-2024-48417](https://insights.sbomify.com/CVE-2024-48417/): Cross-site scripting in edimax:br-6476ac firmware (medium 5.2)
- [CVE-2024-48416](https://insights.sbomify.com/CVE-2024-48416/): Memory corruption in edimax:br-6476ac firmware (high 8.8)
- [CVE-2024-48415](https://insights.sbomify.com/CVE-2024-48415/): Cross-site scripting in razormist:loan management system (medium 4.6)
- [CVE-2024-48411](https://insights.sbomify.com/CVE-2024-48411/): SQL injection in mayurik:online tours \& travels management system (critical 9.8)
- [CVE-2024-48410](https://insights.sbomify.com/CVE-2024-48410/): Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php. (medium 6.1)
- [CVE-2024-4841](https://insights.sbomify.com/CVE-2024-4841/): Path Traversal in parisneo/lollms-webui (medium 4.0)
- [CVE-2024-48406](https://insights.sbomify.com/CVE-2024-48406/): Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the p (critical 9.8)
- [CVE-2024-4840](https://insights.sbomify.com/CVE-2024-4840/): Rhosp-director: cleartext passwords exposed in logs (medium 5.5)
- [CVE-2024-48396](https://insights.sbomify.com/CVE-2024-48396/): AIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). (medium 6.1)
- [CVE-2024-48394](https://insights.sbomify.com/CVE-2024-48394/): A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unpr (high 7.8)
- [CVE-2024-48392](https://insights.sbomify.com/CVE-2024-48392/): Cross-site scripting in orangescrum:orangescrum (medium 5.4)
- [CVE-2024-4839](https://insights.sbomify.com/CVE-2024-4839/): CSRF in Servers Configurations in parisneo/lollms-webui (medium 4.4)
- [CVE-2024-4838](https://insights.sbomify.com/CVE-2024-4838/): ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection (high 7.5)
- [CVE-2024-4837](https://insights.sbomify.com/CVE-2024-4837/): Trust Boundary Violation Vulnerability (medium 5.3)
- [CVE-2024-48360](https://insights.sbomify.com/CVE-2024-48360/): Server-side request forgery in qualitor:qualitor (high 7.5)
- [CVE-2024-4836](https://insights.sbomify.com/CVE-2024-4836/): LFI in sites managed by Edito CMS (high 7.5)
- [CVE-2024-48359](https://insights.sbomify.com/CVE-2024-48359/): Code injection in qualitor:qualitor (critical 9.8)
- [CVE-2024-48357](https://insights.sbomify.com/CVE-2024-48357/): SQL injection in lylme:lylme spage (critical 9.8)
- [CVE-2024-48356](https://insights.sbomify.com/CVE-2024-48356/): SQL injection in lylme:lylme spage (critical 9.8)
- [CVE-2024-48353](https://insights.sbomify.com/CVE-2024-48353/): Hardcoded credentials in yealink:yealink meeting server (high 7.5)
- [CVE-2024-48352](https://insights.sbomify.com/CVE-2024-48352/): Information disclosure in yealink:yealink meeting server (high 7.5)
- [CVE-2024-4835](https://insights.sbomify.com/CVE-2024-4835/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.0)
- [CVE-2024-48346](https://insights.sbomify.com/CVE-2024-48346/): xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. (medium 6.1)
- [CVE-2024-48343](https://insights.sbomify.com/CVE-2024-48343/): SQL injection in esafenet:cdg (medium 6.3)
- [CVE-2024-48341](https://insights.sbomify.com/CVE-2024-48341/): Cross-site request forgery in geeeeeeeek:dingfanzu (low 3.7)
- [CVE-2024-48336](https://insights.sbomify.com/CVE-2024-48336/): The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh (high 8.4)
- [CVE-2024-48325](https://insights.sbomify.com/CVE-2024-48325/): SQL injection in portabilis:i-educar (high 8.1)
- [CVE-2024-48322](https://insights.sbomify.com/CVE-2024-48322/): UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. (high 8.1)
- [CVE-2024-48312](https://insights.sbomify.com/CVE-2024-48312/): WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page. (medium 5.4)
- [CVE-2024-48311](https://insights.sbomify.com/CVE-2024-48311/): Cross-site request forgery in piwigo:piwigo (high 8.8)
- [CVE-2024-48310](https://insights.sbomify.com/CVE-2024-48310/): AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. (high 7.5)
- [CVE-2024-48307](https://insights.sbomify.com/CVE-2024-48307/): JeecgBoot SQL Injection vulnerability (critical 9.8)
- [CVE-2024-48294](https://insights.sbomify.com/CVE-2024-48294/): A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Servi (medium 5.5)
- [CVE-2024-48293](https://insights.sbomify.com/CVE-2024-48293/): Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbit (medium 6.5)
- [CVE-2024-48292](https://insights.sbomify.com/CVE-2024-48292/): An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attacke (high 8.8)
- [CVE-2024-48291](https://insights.sbomify.com/CVE-2024-48291/): Cross-site request forgery in timgreen:dingfanzu cms (medium 6.3)
- [CVE-2024-48290](https://insights.sbomify.com/CVE-2024-48290/): An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) v (medium 4.3)
- [CVE-2024-48289](https://insights.sbomify.com/CVE-2024-48289/): An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via s (medium 6.5)
- [CVE-2024-48288](https://insights.sbomify.com/CVE-2024-48288/): Command injection in tp-link:tl-ipc42c firmware (high 8.0)
- [CVE-2024-48286](https://insights.sbomify.com/CVE-2024-48286/): Command injection in linksys:e3000 firmware (high 8.0)
- [CVE-2024-48284](https://insights.sbomify.com/CVE-2024-48284/): Cross-site scripting in phpgurukul:user registration \& login and user management system (medium 6.1)
- [CVE-2024-48283](https://insights.sbomify.com/CVE-2024-48283/): SQL injection in phpgurukul:user registration \& login and user management system (critical 9.8)
- [CVE-2024-48282](https://insights.sbomify.com/CVE-2024-48282/): SQL injection in phpgurukul:user registration \& login and user management system (high 7.6)
- [CVE-2024-48280](https://insights.sbomify.com/CVE-2024-48280/): SQL injection in phpgurukul:user registration \& login and user management system (high 7.6)
- [CVE-2024-48279](https://insights.sbomify.com/CVE-2024-48279/): Cross-site scripting in phpgurukul:user registration \& login and user management system (high 7.6)
- [CVE-2024-48278](https://insights.sbomify.com/CVE-2024-48278/): Cross-site request forgery in phpgurukul:user registration \& login and user management system (medium 5.5)
- [CVE-2024-48272](https://insights.sbomify.com/CVE-2024-48272/): Hardcoded credentials in dlink:dsl-6740c firmware (medium 6.5)
- [CVE-2024-48271](https://insights.sbomify.com/CVE-2024-48271/): Hardcoded credentials in dlink:dsl-6740c firmware (high 8.8)
- [CVE-2024-48270](https://insights.sbomify.com/CVE-2024-48270/): Information disclosure in misstt123:oasys (high 7.5)
- [CVE-2024-4826](https://insights.sbomify.com/CVE-2024-4826/): SQL injection vulnerability in Simple PHP Shopping Cart (critical 9.3)
- [CVE-2024-48259](https://insights.sbomify.com/CVE-2024-48259/): SQL injection in magicbug:cloudlog (high 7.3)
- [CVE-2024-48257](https://insights.sbomify.com/CVE-2024-48257/): SQL injection in wavelog:wavelog (high 7.3)
- [CVE-2024-48255](https://insights.sbomify.com/CVE-2024-48255/): SQL injection in magicbug:cloudlog (high 7.3)
- [CVE-2024-48253](https://insights.sbomify.com/CVE-2024-48253/): SQL injection in magicbug:cloudlog (high 7.3)
- [CVE-2024-48251](https://insights.sbomify.com/CVE-2024-48251/): SQL injection in wavelog:wavelog (high 7.3)
- [CVE-2024-4825](https://insights.sbomify.com/CVE-2024-4825/): Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo (critical 9.8)
- [CVE-2024-48249](https://insights.sbomify.com/CVE-2024-48249/): SQL injection in wavelog:wavelog (high 7.3)
- [CVE-2024-48248](https://insights.sbomify.com/CVE-2024-48248/): NAKIVO Backup and Replication Absolute Path Traversal (high 8.6, exploited in the wild)
- [CVE-2024-48246](https://insights.sbomify.com/CVE-2024-48246/): Cross-site scripting in janobe:vehicle management system (medium 5.4)
- [CVE-2024-48245](https://insights.sbomify.com/CVE-2024-48245/): SQL injection in janobe:vehicle management system (high 7.2)
- [CVE-2024-48241](https://insights.sbomify.com/CVE-2024-48241/): Memory corruption in radare:radare2 (medium 5.5)
- [CVE-2024-4824](https://insights.sbomify.com/CVE-2024-4824/): SQL Injection in School ERP Pro+Responsive by AROX SOLUTION (critical 9.8)
- [CVE-2024-48239](https://insights.sbomify.com/CVE-2024-48239/): Cross-site scripting in wtcms project:wtcms (medium 4.8)
- [CVE-2024-48238](https://insights.sbomify.com/CVE-2024-48238/): SQL injection in wtcms project:wtcms (medium 4.7)
- [CVE-2024-48237](https://insights.sbomify.com/CVE-2024-48237/): Missing authorization in wtcms project:wtcms (critical 9.8)
- [CVE-2024-48236](https://insights.sbomify.com/CVE-2024-48236/): Code injection in ofcms project:ofcms (medium 6.5)
- [CVE-2024-48235](https://insights.sbomify.com/CVE-2024-48235/): Code injection in ofcms project:ofcms (medium 6.5)
- [CVE-2024-48234](https://insights.sbomify.com/CVE-2024-48234/): An issue was discovered in mipjz 5.0.5. (medium 4.9)
- [CVE-2024-48233](https://insights.sbomify.com/CVE-2024-48233/): Cross-site scripting in mipjz project:mipjz (medium 4.8)
- [CVE-2024-48232](https://insights.sbomify.com/CVE-2024-48232/): Server-side request forgery in mipjz project:mipjz (medium 4.9)
- [CVE-2024-48231](https://insights.sbomify.com/CVE-2024-48231/): SQL injection in funadmin (high 7.2)
- [CVE-2024-48230](https://insights.sbomify.com/CVE-2024-48230/): SQL injection in funadmin (critical 9.8)
- [CVE-2024-4823](https://insights.sbomify.com/CVE-2024-4823/): Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/245/