# Vulnerabilities published in 2024


- [CVE-2024-46475](https://insights.sbomify.com/CVE-2024-46475/): A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute a (medium 4.8)
- [CVE-2024-46472](https://insights.sbomify.com/CVE-2024-46472/): SQL injection in codeastro:membership management system (high 8.6)
- [CVE-2024-46471](https://insights.sbomify.com/CVE-2024-46471/): Information disclosure in codeastro:membership management system (high 7.5)
- [CVE-2024-46470](https://insights.sbomify.com/CVE-2024-46470/): Cross-site scripting in codeastro:membership management system (medium 6.1)
- [CVE-2024-4647](https://insights.sbomify.com/CVE-2024-4647/): Campcodes Complete Web-Based School Management System student_first_payment.php cross site scripting (low 3.5)
- [CVE-2024-46468](https://insights.sbomify.com/CVE-2024-46468/): Server-side request forgery in jpress:jpress (high 7.5)
- [CVE-2024-46467](https://insights.sbomify.com/CVE-2024-46467/): By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them p (high 7.8)
- [CVE-2024-46466](https://insights.sbomify.com/CVE-2024-46466/): By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by (high 7.8)
- [CVE-2024-46465](https://insights.sbomify.com/CVE-2024-46465/): Misconfiguration in primx:cryhod (high 7.8)
- [CVE-2024-46464](https://insights.sbomify.com/CVE-2024-46464/): In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host (high 7.8)
- [CVE-2024-46463](https://insights.sbomify.com/CVE-2024-46463/): By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perf (high 7.8)
- [CVE-2024-46462](https://insights.sbomify.com/CVE-2024-46462/): By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them per (high 7.8)
- [CVE-2024-46461](https://insights.sbomify.com/CVE-2024-46461/): VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a malicious (high 8.0)
- [CVE-2024-4646](https://insights.sbomify.com/CVE-2024-4646/): Campcodes Complete Web-Based School Management System student_payment_details.php cross site scripting (low 3.5)
- [CVE-2024-46455](https://insights.sbomify.com/CVE-2024-46455/): unstructured XML External Entity (XXE) (critical 9.8)
- [CVE-2024-46453](https://insights.sbomify.com/CVE-2024-46453/): Cross-site scripting in honeywell:iq3xcite firmware (medium 6.1)
- [CVE-2024-46452](https://insights.sbomify.com/CVE-2024-46452/): A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to r (medium 6.1)
- [CVE-2024-46451](https://insights.sbomify.com/CVE-2024-46451/): Memory corruption in totolink:t8 firmware (critical 9.8)
- [CVE-2024-46450](https://insights.sbomify.com/CVE-2024-46450/): Auth bypass in tenda:ac6 firmware (high 8.1)
- [CVE-2024-4645](https://insights.sbomify.com/CVE-2024-4645/): SourceCodester Prison Management System changepassword.php cross site scripting (medium 5.3)
- [CVE-2024-46446](https://insights.sbomify.com/CVE-2024-46446/): Path traversal in mecha-cms:mecha (critical 9.1)
- [CVE-2024-46442](https://insights.sbomify.com/CVE-2024-46442/): An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. (critical 9.8)
- [CVE-2024-46441](https://insights.sbomify.com/CVE-2024-46441/): An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/com (high 8.8)
- [CVE-2024-4644](https://insights.sbomify.com/CVE-2024-4644/): SourceCodester Prison Management System changepassword.php cross site scripting (low 3.5)
- [CVE-2024-46437](https://insights.sbomify.com/CVE-2024-46437/): Information disclosure in tenda:w18e firmware (medium 6.5)
- [CVE-2024-46436](https://insights.sbomify.com/CVE-2024-46436/): Hardcoded credentials in tenda:w18e firmware (high 8.3)
- [CVE-2024-46435](https://insights.sbomify.com/CVE-2024-46435/): Memory corruption in tenda:w18e firmware (high 8.0)
- [CVE-2024-46434](https://insights.sbomify.com/CVE-2024-46434/): Auth bypass in tenda:w18e firmware (high 8.8)
- [CVE-2024-46433](https://insights.sbomify.com/CVE-2024-46433/): Hardcoded credentials in tenda:w18e firmware (high 8.8)
- [CVE-2024-46432](https://insights.sbomify.com/CVE-2024-46432/): Missing authorization in tenda:w18e firmware (high 8.8)
- [CVE-2024-46431](https://insights.sbomify.com/CVE-2024-46431/): Memory corruption in tenda:w18e firmware (high 8.0)
- [CVE-2024-46430](https://insights.sbomify.com/CVE-2024-46430/): Auth bypass in tenda:w18e firmware (medium 6.5)
- [CVE-2024-4643](https://insights.sbomify.com/CVE-2024-4643/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-46429](https://insights.sbomify.com/CVE-2024-46429/): Hardcoded credentials in tenda:w18e firmware (high 8.8)
- [CVE-2024-46424](https://insights.sbomify.com/CVE-2024-46424/): Memory corruption in totolink:t8 firmware (high 7.5)
- [CVE-2024-46419](https://insights.sbomify.com/CVE-2024-46419/): Memory corruption in totolink:t8 firmware (critical 9.8)
- [CVE-2024-46413](https://insights.sbomify.com/CVE-2024-46413/): Server-side request forgery in getrebuild:rebuild (medium 5.1)
- [CVE-2024-46412](https://insights.sbomify.com/CVE-2024-46412/): Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sen (medium 6.5)
- [CVE-2024-46410](https://insights.sbomify.com/CVE-2024-46410/): Cross-site scripting in publiccms:publiccms (medium 4.8)
- [CVE-2024-4641](https://insights.sbomify.com/CVE-2024-4641/): OnCell G3470A-LTE Series: Authenticated Format String Errors (medium 6.3)
- [CVE-2024-46409](https://insights.sbomify.com/CVE-2024-46409/): Cross-site scripting in seeddms:seeddms (medium 5.4)
- [CVE-2024-4640](https://insights.sbomify.com/CVE-2024-4640/): OnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmail (high 7.1)
- [CVE-2024-46394](https://insights.sbomify.com/CVE-2024-46394/): Cross-site request forgery in frogcms project:frogcms (high 8.0)
- [CVE-2024-4639](https://insights.sbomify.com/CVE-2024-4639/): OnCell G3470A-LTE Series: Authenticated Command Injection via webDelIPSec (high 7.1)
- [CVE-2024-46383](https://insights.sbomify.com/CVE-2024-46383/): Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext. (low 2.4)
- [CVE-2024-46382](https://insights.sbomify.com/CVE-2024-46382/): SQL injection in linlinjava:litemall (medium 6.5)
- [CVE-2024-4638](https://insights.sbomify.com/CVE-2024-4638/): OnCell G3470A-LTE Series: Authenticated Command Injection via webUploadKey (high 7.1)
- [CVE-2024-46377](https://insights.sbomify.com/CVE-2024-46377/): File upload in mayurik:best house rental management system (critical 9.8)
- [CVE-2024-46376](https://insights.sbomify.com/CVE-2024-46376/): File upload in mayurik:best house rental management system (critical 9.8)
- [CVE-2024-46375](https://insights.sbomify.com/CVE-2024-46375/): File upload in mayurik:best house rental management system (critical 9.8)
- [CVE-2024-46374](https://insights.sbomify.com/CVE-2024-46374/): SQL injection in mayurik:best house rental management system (critical 9.8)
- [CVE-2024-46373](https://insights.sbomify.com/CVE-2024-46373/): File upload in dedecms:dedecms (high 8.8)
- [CVE-2024-46372](https://insights.sbomify.com/CVE-2024-46372/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2024-4637](https://insights.sbomify.com/CVE-2024-4637/): Cross-site scripting in Slider Revolution (medium 6.4)
- [CVE-2024-46367](https://insights.sbomify.com/CVE-2024-46367/): Cross-site scripting in webkul:krayin crm (critical 9.6)
- [CVE-2024-46366](https://insights.sbomify.com/CVE-2024-46366/): Code injection in webkul:krayin crm (high 8.8)
- [CVE-2024-46362](https://insights.sbomify.com/CVE-2024-46362/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-4636](https://insights.sbomify.com/CVE-2024-4636/): Cross-site scripting in Optimole – Optimize Images in Real Time (medium 6.4)
- [CVE-2024-4635](https://insights.sbomify.com/CVE-2024-4635/): Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (medium 6.4)
- [CVE-2024-46341](https://insights.sbomify.com/CVE-2024-46341/): Weak cryptography in tp-link:tl-wr845n firmware (high 8.0)
- [CVE-2024-46340](https://insights.sbomify.com/CVE-2024-46340/): Information disclosure in tp-link:tl-wr845n firmware (critical 9.8)
- [CVE-2024-4634](https://insights.sbomify.com/CVE-2024-4634/): Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-46336](https://insights.sbomify.com/CVE-2024-46336/): Cross-site scripting in kashipara:school management system (medium 6.1)
- [CVE-2024-46335](https://insights.sbomify.com/CVE-2024-46335/): Cross-site scripting in phpgurukul:complaint management system (medium 4.6)
- [CVE-2024-46334](https://insights.sbomify.com/CVE-2024-46334/): Cross-site scripting in kashipara:school management system (medium 6.1)
- [CVE-2024-46333](https://insights.sbomify.com/CVE-2024-46333/): Cross-site scripting in piwigo:piwigo (medium 4.8)
- [CVE-2024-46331](https://insights.sbomify.com/CVE-2024-46331/): Open redirect in modstart:mostartcms (high 7.2)
- [CVE-2024-46330](https://insights.sbomify.com/CVE-2024-46330/): Command injection in vonets:vap11g-300 firmware (high 7.4)
- [CVE-2024-4633](https://insights.sbomify.com/CVE-2024-4633/): Cross-site scripting in Depicter — Popup & Slider Builder (medium 6.4)
- [CVE-2024-46329](https://insights.sbomify.com/CVE-2024-46329/): Command injection in vonets:vap11g-300 firmware (high 8.0)
- [CVE-2024-46328](https://insights.sbomify.com/CVE-2024-46328/): Hardcoded credentials in vonets:vap11g-300 firmware (high 8.0)
- [CVE-2024-46327](https://insights.sbomify.com/CVE-2024-46327/): Path traversal in vonets:vap11g-300 firmware (medium 5.7)
- [CVE-2024-46326](https://insights.sbomify.com/CVE-2024-46326/): Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function. (medium 6.1)
- [CVE-2024-46325](https://insights.sbomify.com/CVE-2024-46325/): Memory corruption in tp-link:wr740n firmware (medium 5.5)
- [CVE-2024-4632](https://insights.sbomify.com/CVE-2024-4632/): Cross-site scripting in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce (medium 6.4)
- [CVE-2024-46316](https://insights.sbomify.com/CVE-2024-46316/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-46313](https://insights.sbomify.com/CVE-2024-46313/): Memory corruption in tp-link:wr941nd firmware (high 8.0)
- [CVE-2024-46310](https://insights.sbomify.com/CVE-2024-46310/): Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose (critical 9.1)
- [CVE-2024-46307](https://insights.sbomify.com/CVE-2024-46307/): Business logic in sparkshop:sparkshop (high 7.5)
- [CVE-2024-46304](https://insights.sbomify.com/CVE-2024-46304/): A NULL pointer dereference in libcoap v4.3.5-rc2 and below allows a remote attacker to cause a denial of service via the coap_handle_request (high 7.5)
- [CVE-2024-46300](https://insights.sbomify.com/CVE-2024-46300/): Cross-site scripting in angeljudesuarez:placement management system (medium 6.1)
- [CVE-2024-4630](https://insights.sbomify.com/CVE-2024-4630/): Cross-site scripting in Starter Templates – AI-Powered Templates for Elementor & Gutenberg (medium 6.4)
- [CVE-2024-46293](https://insights.sbomify.com/CVE-2024-46293/): Missing authorization in oretnom23:online medicine ordering system (critical 9.8)
- [CVE-2024-46292](https://insights.sbomify.com/CVE-2024-46292/): Memory corruption in trustwave:modsecurity (high 7.5)
- [CVE-2024-4629](https://insights.sbomify.com/CVE-2024-4629/): Keycloak: potential bypass of brute force protection (medium 6.5)
- [CVE-2024-46280](https://insights.sbomify.com/CVE-2024-46280/): PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. (high 8.8)
- [CVE-2024-46278](https://insights.sbomify.com/CVE-2024-46278/): Cross-site scripting in sismics:teedy (high 8.4)
- [CVE-2024-46276](https://insights.sbomify.com/CVE-2024-46276/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-46274](https://insights.sbomify.com/CVE-2024-46274/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-4627](https://insights.sbomify.com/CVE-2024-4627/): Rank Math SEO < 1.0.219 - Authenticated Stored XSS (medium 5.5)
- [CVE-2024-46267](https://insights.sbomify.com/CVE-2024-46267/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-46264](https://insights.sbomify.com/CVE-2024-46264/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-46263](https://insights.sbomify.com/CVE-2024-46263/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-46261](https://insights.sbomify.com/CVE-2024-46261/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-4626](https://insights.sbomify.com/CVE-2024-4626/): Cross-site scripting in JetWidgets For Elementor (medium 6.4)
- [CVE-2024-46259](https://insights.sbomify.com/CVE-2024-46259/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-46258](https://insights.sbomify.com/CVE-2024-46258/): Memory corruption in randygaul:cute png (high 7.8)
- [CVE-2024-46257](https://insights.sbomify.com/CVE-2024-46257/): Command injection in jc21:nginx proxy manager (medium 6.3)
- [CVE-2024-46256](https://insights.sbomify.com/CVE-2024-46256/): Command injection in jc21:nginx proxy manager (critical 9.8)
- [CVE-2024-46242](https://insights.sbomify.com/CVE-2024-46242/): An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression De (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/261/