# Vulnerabilities published in 2024


- [CVE-2024-48229](https://insights.sbomify.com/CVE-2024-48229/): SQL injection in funadmin (critical 9.8)
- [CVE-2024-48228](https://insights.sbomify.com/CVE-2024-48228/): Funadmin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-48227](https://insights.sbomify.com/CVE-2024-48227/): Logic flaw in Funadmin (high 7.5)
- [CVE-2024-48226](https://insights.sbomify.com/CVE-2024-48226/): SQL injection in funadmin (critical 9.8)
- [CVE-2024-48225](https://insights.sbomify.com/CVE-2024-48225/): SQL injection in funadmin (critical 9.1)
- [CVE-2024-48224](https://insights.sbomify.com/CVE-2024-48224/): SQL injection in funadmin (high 7.5)
- [CVE-2024-48223](https://insights.sbomify.com/CVE-2024-48223/): SQL injection in funadmin (critical 9.8)
- [CVE-2024-48222](https://insights.sbomify.com/CVE-2024-48222/): SQL injection in funadmin (critical 9.8)
- [CVE-2024-4822](https://insights.sbomify.com/CVE-2024-4822/): Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION (medium 6.5)
- [CVE-2024-48218](https://insights.sbomify.com/CVE-2024-48218/): SQL injection in funadmin (critical 9.8)
- [CVE-2024-48217](https://insights.sbomify.com/CVE-2024-48217/): An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation. (high 8.8)
- [CVE-2024-48214](https://insights.sbomify.com/CVE-2024-48214/): KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. (high 8.4)
- [CVE-2024-48213](https://insights.sbomify.com/CVE-2024-48213/): Path traversal in rockoa:xinhu (medium 4.3)
- [CVE-2024-4821](https://insights.sbomify.com/CVE-2024-4821/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)
- [CVE-2024-48208](https://insights.sbomify.com/CVE-2024-48208/): Memory corruption in pureftpd:pure-ftpd (high 8.6)
- [CVE-2024-48206](https://insights.sbomify.com/CVE-2024-48206/): A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code. (critical 9.8)
- [CVE-2024-48204](https://insights.sbomify.com/CVE-2024-48204/): SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted script. (critical 9.8)
- [CVE-2024-48202](https://insights.sbomify.com/CVE-2024-48202/): File upload in thecosy:icecms (critical 9.8)
- [CVE-2024-48200](https://insights.sbomify.com/CVE-2024-48200/): An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte (high 8.4)
- [CVE-2024-4820](https://insights.sbomify.com/CVE-2024-4820/): SourceCodester Online Computer and Laptop Store unrestricted upload (medium 5.3)
- [CVE-2024-48197](https://insights.sbomify.com/CVE-2024-48197/): Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface. (medium 4.7)
- [CVE-2024-48196](https://insights.sbomify.com/CVE-2024-48196/): Information disclosure in eyoucms:eyoucms (high 7.5)
- [CVE-2024-48195](https://insights.sbomify.com/CVE-2024-48195/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2024-48192](https://insights.sbomify.com/CVE-2024-48192/): Hardcoded credentials in tenda:g3 firmware (high 8.0)
- [CVE-2024-48191](https://insights.sbomify.com/CVE-2024-48191/): Cross-site request forgery in timgreen:dingfanzu cms (medium 6.3)
- [CVE-2024-4819](https://insights.sbomify.com/CVE-2024-4819/): Campcodes Online Laundry Management System admin_class.php improper authorization (medium 5.3)
- [CVE-2024-48180](https://insights.sbomify.com/CVE-2024-48180/): File upload in classcms:classcms (critical 9.8)
- [CVE-2024-4818](https://insights.sbomify.com/CVE-2024-4818/): Campcodes Online Laundry Management System index.php file inclusion (medium 6.9)
- [CVE-2024-48178](https://insights.sbomify.com/CVE-2024-48178/): Server-side request forgery in newbee-mall project:newbee-mall (high 8.1)
- [CVE-2024-48177](https://insights.sbomify.com/CVE-2024-48177/): SQL injection in mrcms:mrcms (high 8.8)
- [CVE-2024-48176](https://insights.sbomify.com/CVE-2024-48176/): Auth bypass in lylme:lylme spage (critical 9.8)
- [CVE-2024-48170](https://insights.sbomify.com/CVE-2024-48170/): Cross-site scripting in phpgurukul:small crm (medium 5.4)
- [CVE-2024-4817](https://insights.sbomify.com/CVE-2024-4817/): Campcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injection (medium 5.3)
- [CVE-2024-48168](https://insights.sbomify.com/CVE-2024-48168/): Memory corruption in dlink:dcs-960l firmware (critical 9.8)
- [CVE-2024-4816](https://insights.sbomify.com/CVE-2024-4816/): Ruijie RG-UAC gre_add_commit.php os command injection (medium 5.3)
- [CVE-2024-48153](https://insights.sbomify.com/CVE-2024-48153/): Command injection in draytek:vigor3900 firmware (critical 9.8)
- [CVE-2024-48150](https://insights.sbomify.com/CVE-2024-48150/): Memory corruption in dlink:dir-820l firmware (critical 9.8)
- [CVE-2024-4815](https://insights.sbomify.com/CVE-2024-4815/): Ruijie RG-UAC detail.php os command injection (medium 5.3)
- [CVE-2024-48145](https://insights.sbomify.com/CVE-2024-48145/): A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate (critical 9.1)
- [CVE-2024-48144](https://insights.sbomify.com/CVE-2024-48144/): A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exf (critical 9.1)
- [CVE-2024-48143](https://insights.sbomify.com/CVE-2024-48143/): A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the (critical 9.1)
- [CVE-2024-48142](https://insights.sbomify.com/CVE-2024-48142/): A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access an (high 7.5)
- [CVE-2024-48141](https://insights.sbomify.com/CVE-2024-48141/): A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subs (high 7.5)
- [CVE-2024-48140](https://insights.sbomify.com/CVE-2024-48140/): A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attacke (high 7.5)
- [CVE-2024-4814](https://insights.sbomify.com/CVE-2024-4814/): Ruijie RG-UAC static_route_edit_commit.php os command injection (medium 5.3)
- [CVE-2024-48139](https://insights.sbomify.com/CVE-2024-48139/): A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent (high 7.5)
- [CVE-2024-48138](https://insights.sbomify.com/CVE-2024-48138/): A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows at (critical 9.8)
- [CVE-2024-4813](https://insights.sbomify.com/CVE-2024-4813/): Ruijie RG-UAC interface_commit.php os command injection (medium 5.3)
- [CVE-2024-48126](https://insights.sbomify.com/CVE-2024-48126/): HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access. (critical 9.8)
- [CVE-2024-48125](https://insights.sbomify.com/CVE-2024-48125/): An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests. (high 7.5)
- [CVE-2024-48123](https://insights.sbomify.com/CVE-2024-48123/): An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted s (high 8.4)
- [CVE-2024-48122](https://insights.sbomify.com/CVE-2024-48122/): Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges. (medium 6.7)
- [CVE-2024-48121](https://insights.sbomify.com/CVE-2024-48121/): The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. (medium 6.5)
- [CVE-2024-48120](https://insights.sbomify.com/CVE-2024-48120/): Cross-site scripting in x2engine:x2crm (medium 6.5)
- [CVE-2024-4812](https://insights.sbomify.com/CVE-2024-4812/): Katello: potential cross-site scripting exploit in ui (medium 4.8)
- [CVE-2024-48119](https://insights.sbomify.com/CVE-2024-48119/): Cross-site scripting in vtiger:vtiger crm (medium 5.4)
- [CVE-2024-48112](https://insights.sbomify.com/CVE-2024-48112/): ThinkPHP deserialization vulnerability (critical 9.8)
- [CVE-2024-4811](https://insights.sbomify.com/CVE-2024-4811/): Missing authorization in Octopus Server (low 2.2)
- [CVE-2024-48107](https://insights.sbomify.com/CVE-2024-48107/): Server-side request forgery in sparkshop:sparkshop (medium 6.5)
- [CVE-2024-48093](https://insights.sbomify.com/CVE-2024-48093/): Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading (high 8.0)
- [CVE-2024-48091](https://insights.sbomify.com/CVE-2024-48091/): Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. (high 7.8)
- [CVE-2024-4809](https://insights.sbomify.com/CVE-2024-4809/): SourceCodester Open Source Clinic Management System setting.php unrestricted upload (medium 5.3)
- [CVE-2024-48080](https://insights.sbomify.com/CVE-2024-48080/): An issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request. (high 7.5)
- [CVE-2024-4808](https://insights.sbomify.com/CVE-2024-4808/): Kashipara College Management System delete_faculty.php sql injection (medium 5.3)
- [CVE-2024-48077](https://insights.sbomify.com/CVE-2024-48077/): Denial of service in emqx:nanomq (high 7.5)
- [CVE-2024-48075](https://insights.sbomify.com/CVE-2024-48075/): A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote att (medium 5.3)
- [CVE-2024-48074](https://insights.sbomify.com/CVE-2024-48074/): Command injection in draytek:vigor2960 firmware (high 8.0)
- [CVE-2024-48073](https://insights.sbomify.com/CVE-2024-48073/): sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. (critical 9.8)
- [CVE-2024-48072](https://insights.sbomify.com/CVE-2024-48072/): SQL injection in weaver:e-cology (critical 9.8)
- [CVE-2024-48071](https://insights.sbomify.com/CVE-2024-48071/): Path traversal in weaver:e-cology (medium 6.5)
- [CVE-2024-48070](https://insights.sbomify.com/CVE-2024-48070/): Code injection in weaver:e-cology (critical 9.8)
- [CVE-2024-4807](https://insights.sbomify.com/CVE-2024-4807/): Kashipara College Management System delete_user.php sql injection (medium 5.3)
- [CVE-2024-48069](https://insights.sbomify.com/CVE-2024-48069/): Race condition in weaver:e-cology (critical 9.8)
- [CVE-2024-48068](https://insights.sbomify.com/CVE-2024-48068/): A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbi (medium 6.1)
- [CVE-2024-48063](https://insights.sbomify.com/CVE-2024-48063/): Deserialization in linuxfoundation:pytorch (critical 9.8)
- [CVE-2024-48061](https://insights.sbomify.com/CVE-2024-48061/): Langflow vulnerable to remote code execution (critical 9.8)
- [CVE-2024-4806](https://insights.sbomify.com/CVE-2024-4806/): Kashipara College Management System each_extracurricula_activities.php sql injection (medium 5.3)
- [CVE-2024-48059](https://insights.sbomify.com/CVE-2024-48059/): Cross-site scripting in gaizhenbiao:chuanhuchatgpt (medium 6.1)
- [CVE-2024-48057](https://insights.sbomify.com/CVE-2024-48057/): LocalAI Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-48052](https://insights.sbomify.com/CVE-2024-48052/): gradio Server Side Request Forgery vulnerability (medium 6.5)
- [CVE-2024-48050](https://insights.sbomify.com/CVE-2024-48050/): AgentScope uses `eval` (critical 9.8)
- [CVE-2024-4805](https://insights.sbomify.com/CVE-2024-4805/): Kashipara College Management System edit_faculty.php sql injection (medium 5.3)
- [CVE-2024-48049](https://insights.sbomify.com/CVE-2024-48049/): WordPress Mighty Builder plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-48048](https://insights.sbomify.com/CVE-2024-48048/): WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-48047](https://insights.sbomify.com/CVE-2024-48047/): WordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-48046](https://insights.sbomify.com/CVE-2024-48046/): WordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-48045](https://insights.sbomify.com/CVE-2024-48045/): WordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-48044](https://insights.sbomify.com/CVE-2024-48044/): WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-48043](https://insights.sbomify.com/CVE-2024-48043/): WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-48042](https://insights.sbomify.com/CVE-2024-48042/): WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-48041](https://insights.sbomify.com/CVE-2024-48041/): WordPress CM Tooltip Glossary plugin <= 4.3.9 - Stored Cross-Site Scripting vulnerability (medium 6.5)
- [CVE-2024-48040](https://insights.sbomify.com/CVE-2024-48040/): WordPress Tainacan plugin <= 0.21.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-4804](https://insights.sbomify.com/CVE-2024-4804/): Kashipara College Management System edit_user.php sql injection (medium 5.3)
- [CVE-2024-48039](https://insights.sbomify.com/CVE-2024-48039/): WordPress CubeWP Framework plugin <= 1.1.15 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-48038](https://insights.sbomify.com/CVE-2024-48038/): WordPress wp-Monalisa plugin <= 6.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-48037](https://insights.sbomify.com/CVE-2024-48037/): WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerability (medium 5.4)
- [CVE-2024-48036](https://insights.sbomify.com/CVE-2024-48036/): WordPress SKT Blocks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-48035](https://insights.sbomify.com/CVE-2024-48035/): WordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-48034](https://insights.sbomify.com/CVE-2024-48034/): WordPress Creates 3D Flipbook, PDF Flipbook plugin <= 1.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-48033](https://insights.sbomify.com/CVE-2024-48033/): WordPress Talkback plugin <= 1.0 - PHP Object Injection vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/246/