# Vulnerabilities published in 2024


- [CVE-2024-44905](https://insights.sbomify.com/CVE-2024-44905/): go-pg SQL injection vulnerability via the component /types/append_value.go (medium 6.5)
- [CVE-2024-44903](https://insights.sbomify.com/CVE-2024-44903/): SQL injection in IPAC20 (high 7.5)
- [CVE-2024-44902](https://insights.sbomify.com/CVE-2024-44902/): ThinkPHP deserialization vulnerability (critical 9.8)
- [CVE-2024-4490](https://insights.sbomify.com/CVE-2024-4490/): Cross-site scripting in Divi (medium 6.4)
- [CVE-2024-44893](https://insights.sbomify.com/CVE-2024-44893/): Privilege escalation in jeecg:jimureport (critical 9.8)
- [CVE-2024-4489](https://insights.sbomify.com/CVE-2024-4489/): Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads (medium 6.4)
- [CVE-2024-4488](https://insights.sbomify.com/CVE-2024-4488/): Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-44872](https://insights.sbomify.com/CVE-2024-44872/): Cross-site scripting in mozilo:mozilocms (medium 6.1)
- [CVE-2024-44871](https://insights.sbomify.com/CVE-2024-44871/): File upload in mozilo:mozilocms (high 7.2)
- [CVE-2024-4487](https://insights.sbomify.com/CVE-2024-4487/): Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads (medium 6.4)
- [CVE-2024-44867](https://insights.sbomify.com/CVE-2024-44867/): Path traversal in phpok:phpok (high 7.5)
- [CVE-2024-44866](https://insights.sbomify.com/CVE-2024-44866/): A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denia (medium 6.8)
- [CVE-2024-44860](https://insights.sbomify.com/CVE-2024-44860/): Information disclosure in solvait:solvait (high 7.5)
- [CVE-2024-4486](https://insights.sbomify.com/CVE-2024-4486/): Cross-site scripting in Awesome Contact Form7 for Elementor (medium 6.4)
- [CVE-2024-44859](https://insights.sbomify.com/CVE-2024-44859/): Memory corruption in tenda:fh1201 firmware (high 8.0)
- [CVE-2024-44856](https://insights.sbomify.com/CVE-2024-44856/): Null dereference in openrobotics:robot operating system (high 7.5)
- [CVE-2024-44855](https://insights.sbomify.com/CVE-2024-44855/): Null dereference in openrobotics:robot operating system (high 7.5)
- [CVE-2024-44854](https://insights.sbomify.com/CVE-2024-44854/): Null dereference in openrobotics:robot operating system (high 7.5)
- [CVE-2024-44853](https://insights.sbomify.com/CVE-2024-44853/): Null dereference in openrobotics:robot operating system (high 7.5)
- [CVE-2024-44852](https://insights.sbomify.com/CVE-2024-44852/): Memory corruption in openrobotics:robot operating system (high 7.5)
- [CVE-2024-44851](https://insights.sbomify.com/CVE-2024-44851/): Cross-site scripting in perfexcrm:perfex crm (medium 5.4)
- [CVE-2024-4485](https://insights.sbomify.com/CVE-2024-4485/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-44849](https://insights.sbomify.com/CVE-2024-44849/): File upload in qualitor:qualitor (critical 9.8)
- [CVE-2024-44845](https://insights.sbomify.com/CVE-2024-44845/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-44844](https://insights.sbomify.com/CVE-2024-44844/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-44843](https://insights.sbomify.com/CVE-2024-44843/): Auth bypass in steve-community:steve (medium 5.9)
- [CVE-2024-4484](https://insights.sbomify.com/CVE-2024-4484/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-44839](https://insights.sbomify.com/CVE-2024-44839/): SQL injection in openrapid:rapidcms (critical 9.8)
- [CVE-2024-44838](https://insights.sbomify.com/CVE-2024-44838/): SQL injection in openrapid:rapidcms (critical 9.8)
- [CVE-2024-44837](https://insights.sbomify.com/CVE-2024-44837/): Cross-site scripting in deathbreak:drug (medium 5.4)
- [CVE-2024-4483](https://insights.sbomify.com/CVE-2024-4483/): Email Encoder < 2.2.2 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-44825](https://insights.sbomify.com/CVE-2024-44825/): Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitr (high 7.5)
- [CVE-2024-44821](https://insights.sbomify.com/CVE-2024-44821/): Security feature bypass in zzcms:zzcms (medium 5.3)
- [CVE-2024-44820](https://insights.sbomify.com/CVE-2024-44820/): Information disclosure in zzcms:zzcms (high 7.5)
- [CVE-2024-4482](https://insights.sbomify.com/CVE-2024-4482/): The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (medium 6.4)
- [CVE-2024-44819](https://insights.sbomify.com/CVE-2024-44819/): Cross-site scripting in zzcms:zzcms (medium 6.1)
- [CVE-2024-44818](https://insights.sbomify.com/CVE-2024-44818/): Cross-site scripting in zzcms:zzcms (medium 5.4)
- [CVE-2024-44817](https://insights.sbomify.com/CVE-2024-44817/): SQL injection in zzcms:zzcms (high 8.8)
- [CVE-2024-44815](https://insights.sbomify.com/CVE-2024-44815/): Information disclosure in hathway:skyworth cm5100-511 firmware (high 8.0)
- [CVE-2024-44812](https://insights.sbomify.com/CVE-2024-44812/): SQL injection in janobe:online complaint site (critical 9.8)
- [CVE-2024-4481](https://insights.sbomify.com/CVE-2024-4481/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-44809](https://insights.sbomify.com/CVE-2024-44809/): A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA. (critical 9.8)
- [CVE-2024-44808](https://insights.sbomify.com/CVE-2024-44808/): An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter. (critical 9.8)
- [CVE-2024-44807](https://insights.sbomify.com/CVE-2024-44807/): A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. (medium 5.3)
- [CVE-2024-4480](https://insights.sbomify.com/CVE-2024-4480/): WP Prayer II <= 2.4.7 - Email Settings Update via CSRF (medium 6.1)
- [CVE-2024-44798](https://insights.sbomify.com/CVE-2024-44798/): Cross-site scripting in anujk305:bus pass management system (medium 6.3)
- [CVE-2024-44797](https://insights.sbomify.com/CVE-2024-44797/): Cross-site scripting in gazelle project:gazelle (medium 5.4)
- [CVE-2024-44796](https://insights.sbomify.com/CVE-2024-44796/): Cross-site scripting in xiebruce:picuploader (high 8.0)
- [CVE-2024-44795](https://insights.sbomify.com/CVE-2024-44795/): Cross-site scripting in gazelle project:gazelle (medium 6.1)
- [CVE-2024-44794](https://insights.sbomify.com/CVE-2024-44794/): Cross-site scripting in xiebruce:picuploader (medium 6.1)
- [CVE-2024-44793](https://insights.sbomify.com/CVE-2024-44793/): Cross-site scripting in gazelle project:gazelle (medium 6.1)
- [CVE-2024-4479](https://insights.sbomify.com/CVE-2024-4479/): Cross-site scripting in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (medium 6.4)
- [CVE-2024-44786](https://insights.sbomify.com/CVE-2024-44786/): Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors. (high 7.5)
- [CVE-2024-4478](https://insights.sbomify.com/CVE-2024-4478/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2024-44779](https://insights.sbomify.com/CVE-2024-44779/): Cross-site scripting in vtiger:vtiger crm (high 7.4)
- [CVE-2024-44778](https://insights.sbomify.com/CVE-2024-44778/): Cross-site scripting in vtiger:vtiger crm (high 7.4)
- [CVE-2024-44777](https://insights.sbomify.com/CVE-2024-44777/): Cross-site scripting in vtiger:vtiger crm (high 7.4)
- [CVE-2024-44776](https://insights.sbomify.com/CVE-2024-44776/): Open redirect in vtiger:vtiger crm (medium 6.1)
- [CVE-2024-44775](https://insights.sbomify.com/CVE-2024-44775/): Null dereference in davidepianca98:kmqtt (high 7.5)
- [CVE-2024-44771](https://insights.sbomify.com/CVE-2024-44771/): BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function. (medium 6.1)
- [CVE-2024-4477](https://insights.sbomify.com/CVE-2024-4477/): WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS (medium 4.3)
- [CVE-2024-44765](https://insights.sbomify.com/CVE-2024-44765/): An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privil (medium 6.5)
- [CVE-2024-44762](https://insights.sbomify.com/CVE-2024-44762/): Information disclosure in webmin:usermin (medium 5.3)
- [CVE-2024-44761](https://insights.sbomify.com/CVE-2024-44761/): Path traversal in gzequan:eq enterprise management system (critical 9.9)
- [CVE-2024-44760](https://insights.sbomify.com/CVE-2024-44760/): Information disclosure in sunmochina:enterprise management system (critical 9.1)
- [CVE-2024-44759](https://insights.sbomify.com/CVE-2024-44759/): Path traversal in nuserp:nus-m9 erp (high 7.5)
- [CVE-2024-44758](https://insights.sbomify.com/CVE-2024-44758/): File upload in nuserp:nus-m9 erp (critical 9.8)
- [CVE-2024-44757](https://insights.sbomify.com/CVE-2024-44757/): Path traversal in nuserp:nus-m9 erp (high 7.5)
- [CVE-2024-44756](https://insights.sbomify.com/CVE-2024-44756/): SQL injection in nuserp:nus-m9 erp (critical 9.8)
- [CVE-2024-44754](https://insights.sbomify.com/CVE-2024-44754/): Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject mo (medium 6.8)
- [CVE-2024-4475](https://insights.sbomify.com/CVE-2024-4475/): WP Logs Book <= 1.0.1 - Log Clearing via CSRF (medium 4.3)
- [CVE-2024-44744](https://insights.sbomify.com/CVE-2024-44744/): An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. (medium 5.7)
- [CVE-2024-4474](https://insights.sbomify.com/CVE-2024-4474/): WP Logs Book <= 1.0.1 - Disable Logging via CSRF (medium 4.3)
- [CVE-2024-44739](https://insights.sbomify.com/CVE-2024-44739/): SQL injection in oretnom23:simple forum website (high 8.8)
- [CVE-2024-44734](https://insights.sbomify.com/CVE-2024-44734/): Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction (high 7.5)
- [CVE-2024-44731](https://insights.sbomify.com/CVE-2024-44731/): Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execu (medium 4.7)
- [CVE-2024-44730](https://insights.sbomify.com/CVE-2024-44730/): Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat (critical 9.1)
- [CVE-2024-4473](https://insights.sbomify.com/CVE-2024-4473/): Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget (medium 6.4)
- [CVE-2024-44729](https://insights.sbomify.com/CVE-2024-44729/): Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presen (high 7.5)
- [CVE-2024-44728](https://insights.sbomify.com/CVE-2024-44728/): Cross-site scripting in angeljudesuarez:event management system (high 7.6)
- [CVE-2024-44727](https://insights.sbomify.com/CVE-2024-44727/): SQL injection in angeljudesuarez:event management system (high 7.4)
- [CVE-2024-44725](https://insights.sbomify.com/CVE-2024-44725/): SQL injection in autocms project:autocms (high 7.2)
- [CVE-2024-44724](https://insights.sbomify.com/CVE-2024-44724/): Code injection in autocms project:autocms (high 7.2)
- [CVE-2024-44722](https://insights.sbomify.com/CVE-2024-44722/): Command injection in anolis:sysak (critical 9.8)
- [CVE-2024-44721](https://insights.sbomify.com/CVE-2024-44721/): Server-side request forgery in seacms:seacms (critical 9.8)
- [CVE-2024-44720](https://insights.sbomify.com/CVE-2024-44720/): Path traversal in seacms:seacms (high 7.5)
- [CVE-2024-4472](https://insights.sbomify.com/CVE-2024-4472/): Insertion of Sensitive Information into Log File in GitLab (medium 4.0)
- [CVE-2024-44717](https://insights.sbomify.com/CVE-2024-44717/): Cross-site scripting in dedebiz:dedebiz (medium 6.1)
- [CVE-2024-44716](https://insights.sbomify.com/CVE-2024-44716/): Cross-site scripting in dedebiz:dedebiz (medium 6.1)
- [CVE-2024-4471](https://insights.sbomify.com/CVE-2024-4471/): 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection (high 8.0)
- [CVE-2024-4470](https://insights.sbomify.com/CVE-2024-4470/): Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-4469](https://insights.sbomify.com/CVE-2024-4469/): Migration Backup Restore < 3.5.0 - Admin+ SSRF (high 7.5)
- [CVE-2024-44685](https://insights.sbomify.com/CVE-2024-44685/): Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including password (medium 5.0)
- [CVE-2024-44684](https://insights.sbomify.com/CVE-2024-44684/): Cross-site scripting in tpmecms:tpmecms (medium 6.1)
- [CVE-2024-44683](https://insights.sbomify.com/CVE-2024-44683/): Cross-site scripting in seacms:seacms (medium 6.1)
- [CVE-2024-44682](https://insights.sbomify.com/CVE-2024-44682/): Cross-site scripting in shopxo:shopxo (medium 6.1)
- [CVE-2024-4468](https://insights.sbomify.com/CVE-2024-4468/): Salon booking system <= 9.9 - Missing Authorization (medium 4.3)
- [CVE-2024-44678](https://insights.sbomify.com/CVE-2024-44678/): Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. (high 8.0)
- [CVE-2024-44677](https://insights.sbomify.com/CVE-2024-44677/): Server-side request forgery in eladmin:eladmin (critical 9.8)
- [CVE-2024-44676](https://insights.sbomify.com/CVE-2024-44676/): Cross-site scripting in eladmin:eladmin (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/272/