# Vulnerabilities published in 2024


- [CVE-2024-44674](https://insights.sbomify.com/CVE-2024-44674/): Memory corruption in dlink:covr-2600r firmware (medium 5.7)
- [CVE-2024-4467](https://insights.sbomify.com/CVE-2024-4467/): Qemu-kvm: 'qemu-img info' leads to host file read/write (high 7.8)
- [CVE-2024-44667](https://insights.sbomify.com/CVE-2024-44667/): Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Control. (high 8.0)
- [CVE-2024-44664](https://insights.sbomify.com/CVE-2024-44664/): SQL injection in phpgurukul:online shopping portal (medium 6.5)
- [CVE-2024-44663](https://insights.sbomify.com/CVE-2024-44663/): SQL injection in phpgurukul:online shopping portal (medium 6.5)
- [CVE-2024-44662](https://insights.sbomify.com/CVE-2024-44662/): SQL injection in phpgurukul:online shopping portal (medium 6.5)
- [CVE-2024-44661](https://insights.sbomify.com/CVE-2024-44661/): Cross-site scripting in phpgurukul:online shopping portal (medium 5.4)
- [CVE-2024-44660](https://insights.sbomify.com/CVE-2024-44660/): SQL injection in phpgurukul:online shopping portal (medium 6.5)
- [CVE-2024-4466](https://insights.sbomify.com/CVE-2024-4466/): SQL injection vulnerability in Gescen (critical 9.8)
- [CVE-2024-44659](https://insights.sbomify.com/CVE-2024-44659/): SQL injection in phpgurukul:online shopping portal (critical 9.8)
- [CVE-2024-44658](https://insights.sbomify.com/CVE-2024-44658/): SQL injection in phpgurukul:complaint management system (medium 6.5)
- [CVE-2024-44657](https://insights.sbomify.com/CVE-2024-44657/): SQL injection in phpgurukul:complaint management system (medium 6.5)
- [CVE-2024-44655](https://insights.sbomify.com/CVE-2024-44655/): Cross-site scripting in phpgurukul:complaint management system (medium 6.1)
- [CVE-2024-44654](https://insights.sbomify.com/CVE-2024-44654/): SQL injection in phpgurukul:complaint management system (medium 6.5)
- [CVE-2024-44653](https://insights.sbomify.com/CVE-2024-44653/): SQL injection in kashipara:ecommerce website (medium 6.5)
- [CVE-2024-44652](https://insights.sbomify.com/CVE-2024-44652/): SQL injection in kashipara:ecommerce website (medium 6.5)
- [CVE-2024-44651](https://insights.sbomify.com/CVE-2024-44651/): SQL injection in kashipara:ecommerce website (medium 6.5)
- [CVE-2024-4465](https://insights.sbomify.com/CVE-2024-4465/): Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0 (medium 5.8)
- [CVE-2024-44648](https://insights.sbomify.com/CVE-2024-44648/): SQL injection in phpgurukul:small crm (medium 6.5)
- [CVE-2024-44647](https://insights.sbomify.com/CVE-2024-44647/): Cross-site scripting in phpgurukul:small crm (medium 6.1)
- [CVE-2024-44644](https://insights.sbomify.com/CVE-2024-44644/): SQL injection in phpgurukul:small crm (medium 6.5)
- [CVE-2024-44641](https://insights.sbomify.com/CVE-2024-44641/): SQL injection in phpgurukul:small crm (medium 6.5)
- [CVE-2024-44640](https://insights.sbomify.com/CVE-2024-44640/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-4464](https://insights.sbomify.com/CVE-2024-4464/): Auth bypass in Media Server (high 7.5)
- [CVE-2024-44639](https://insights.sbomify.com/CVE-2024-44639/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-44636](https://insights.sbomify.com/CVE-2024-44636/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-44635](https://insights.sbomify.com/CVE-2024-44635/): Cross-site scripting in phpgurukul:student record system (medium 6.1)
- [CVE-2024-44633](https://insights.sbomify.com/CVE-2024-44633/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-44632](https://insights.sbomify.com/CVE-2024-44632/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-44630](https://insights.sbomify.com/CVE-2024-44630/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-4463](https://insights.sbomify.com/CVE-2024-4463/): Squelch Tabs and Accordions Shortcodes <= 0.4.7 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-44625](https://insights.sbomify.com/CVE-2024-44625/): Remote Code Execution in Gogs (high 8.8)
- [CVE-2024-44623](https://insights.sbomify.com/CVE-2024-44623/): Code injection in spx:spx graphics controller (high 7.3)
- [CVE-2024-4462](https://insights.sbomify.com/CVE-2024-4462/): Nafeza Prayer Time <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-44610](https://insights.sbomify.com/CVE-2024-44610/): PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters i (medium 5.6)
- [CVE-2024-4461](https://insights.sbomify.com/CVE-2024-4461/): Unquoted path or search item vulnerability in SugarSync (high 7.8)
- [CVE-2024-44599](https://insights.sbomify.com/CVE-2024-44599/): Path traversal in fntsoftware:fnt command (high 8.3)
- [CVE-2024-44598](https://insights.sbomify.com/CVE-2024-44598/): File upload in fntsoftware:fnt command (high 8.8)
- [CVE-2024-4459](https://insights.sbomify.com/CVE-2024-4459/): Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles (medium 6.4)
- [CVE-2024-44589](https://insights.sbomify.com/CVE-2024-44589/): Memory corruption in dlink:dcs-960l firmware (high 8.8)
- [CVE-2024-44587](https://insights.sbomify.com/CVE-2024-44587/): SQL injection in adonesevangelista:restaurant management system (high 8.8)
- [CVE-2024-4458](https://insights.sbomify.com/CVE-2024-4458/): Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs (medium 6.4)
- [CVE-2024-44577](https://insights.sbomify.com/CVE-2024-44577/): Command injection in relyum:rely-pcie firmware (high 8.8)
- [CVE-2024-44575](https://insights.sbomify.com/CVE-2024-44575/): Information disclosure in relyum:rely-pcie firmware (low 3.7)
- [CVE-2024-44574](https://insights.sbomify.com/CVE-2024-44574/): Command injection in relyum:rely-pcie firmware (high 8.8)
- [CVE-2024-44573](https://insights.sbomify.com/CVE-2024-44573/): Cross-site scripting in relyum:rely-pcie firmware (medium 4.7)
- [CVE-2024-44572](https://insights.sbomify.com/CVE-2024-44572/): Command injection in relyum:rely-pcie firmware (high 8.8)
- [CVE-2024-44571](https://insights.sbomify.com/CVE-2024-44571/): Missing authorization in relyum:rely-pcie firmware (high 8.8)
- [CVE-2024-44570](https://insights.sbomify.com/CVE-2024-44570/): Code injection in relyum:rely-pcie firmware (high 8.8)
- [CVE-2024-4457](https://insights.sbomify.com/CVE-2024-4457/): Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (critical 9.1)
- [CVE-2024-44565](https://insights.sbomify.com/CVE-2024-44565/): Memory corruption in tenda:ax1806 firmware (high 8.0)
- [CVE-2024-44563](https://insights.sbomify.com/CVE-2024-44563/): Memory corruption in tenda:ax1806 firmware (high 8.0)
- [CVE-2024-4456](https://insights.sbomify.com/CVE-2024-4456/): Cross-site scripting in Octopus Server (medium 4.1)
- [CVE-2024-44558](https://insights.sbomify.com/CVE-2024-44558/): Memory corruption in tenda:ax1806 firmware (high 8.8)
- [CVE-2024-44557](https://insights.sbomify.com/CVE-2024-44557/): Memory corruption in tenda:ax1806 firmware (high 8.0)
- [CVE-2024-44556](https://insights.sbomify.com/CVE-2024-44556/): Memory corruption in tenda:ax1806 firmware (medium 6.6)
- [CVE-2024-44555](https://insights.sbomify.com/CVE-2024-44555/): Memory corruption in tenda:ax1806 firmware (critical 9.8)
- [CVE-2024-44553](https://insights.sbomify.com/CVE-2024-44553/): Memory corruption in tenda:ax1806 firmware (high 8.8)
- [CVE-2024-44552](https://insights.sbomify.com/CVE-2024-44552/): Memory corruption in tenda:ax1806 firmware (medium 6.6)
- [CVE-2024-44551](https://insights.sbomify.com/CVE-2024-44551/): Memory corruption in tenda:ax1806 firmware (critical 9.8)
- [CVE-2024-44550](https://insights.sbomify.com/CVE-2024-44550/): Memory corruption in tenda:ax1806 firmware (high 8.8)
- [CVE-2024-4455](https://insights.sbomify.com/CVE-2024-4455/): YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-44549](https://insights.sbomify.com/CVE-2024-44549/): Memory corruption in tenda:ax1806 firmware (medium 6.6)
- [CVE-2024-44546](https://insights.sbomify.com/CVE-2024-44546/): SQL injection in powerjob:powerjob (critical 9.8)
- [CVE-2024-44542](https://insights.sbomify.com/CVE-2024-44542/): SQL injection in todesk:todesk (critical 9.8)
- [CVE-2024-44541](https://insights.sbomify.com/CVE-2024-44541/): evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin." (critical 9.8)
- [CVE-2024-44540](https://insights.sbomify.com/CVE-2024-44540/): Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port. (medium 6.6)
- [CVE-2024-4454](https://insights.sbomify.com/CVE-2024-4454/): WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability (high 7.3)
- [CVE-2024-4453](https://insights.sbomify.com/CVE-2024-4453/): GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-4452](https://insights.sbomify.com/CVE-2024-4452/): ElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-4451](https://insights.sbomify.com/CVE-2024-4451/): Cross-site scripting in Colibri Page Builder (medium 6.4)
- [CVE-2024-4450](https://insights.sbomify.com/CVE-2024-4450/): AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions (medium 6.3)
- [CVE-2024-4449](https://insights.sbomify.com/CVE-2024-4449/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-4448](https://insights.sbomify.com/CVE-2024-4448/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-4447](https://insights.sbomify.com/CVE-2024-4447/): Missing authorization in dotCMS core (critical 9.9)
- [CVE-2024-44466](https://insights.sbomify.com/CVE-2024-44466/): Command injection in comfast:cf-xr11 firmware (critical 9.8)
- [CVE-2024-44460](https://insights.sbomify.com/CVE-2024-44460/): Memory corruption in emqx:nanomq (high 7.5)
- [CVE-2024-4446](https://insights.sbomify.com/CVE-2024-4446/): Cross-site scripting in Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor) (medium 6.4)
- [CVE-2024-44459](https://insights.sbomify.com/CVE-2024-44459/): Denial of service in octavolabs:vernemq (high 7.5)
- [CVE-2024-44450](https://insights.sbomify.com/CVE-2024-44450/): Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. (medium 5.4)
- [CVE-2024-4445](https://insights.sbomify.com/CVE-2024-4445/): WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorization (medium 6.5)
- [CVE-2024-44449](https://insights.sbomify.com/CVE-2024-44449/): Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg para (medium 6.1)
- [CVE-2024-4444](https://insights.sbomify.com/CVE-2024-4444/): LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration (medium 5.3)
- [CVE-2024-44439](https://insights.sbomify.com/CVE-2024-44439/): An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows (medium 5.9)
- [CVE-2024-44430](https://insights.sbomify.com/CVE-2024-44430/): SQL injection in mayurik:best free law office management (critical 9.8)
- [CVE-2024-4443](https://insights.sbomify.com/CVE-2024-4443/): SQL injection in Business Directory Plugin – Easy Listing Directories for WordPress (critical 9.8)
- [CVE-2024-4442](https://insights.sbomify.com/CVE-2024-4442/): Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion (critical 9.1)
- [CVE-2024-44415](https://insights.sbomify.com/CVE-2024-44415/): A vulnerability was discovered in DI_8200-16.07.26A1, There is a buffer overflow in the dbsrv_asp function; The strcpy function is executed (medium 6.5)
- [CVE-2024-44414](https://insights.sbomify.com/CVE-2024-44414/): A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. (high 8.8)
- [CVE-2024-44413](https://insights.sbomify.com/CVE-2024-44413/): A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. (high 8.8)
- [CVE-2024-44411](https://insights.sbomify.com/CVE-2024-44411/): Command injection in dlink:di-8300 firmware (critical 9.8)
- [CVE-2024-44410](https://insights.sbomify.com/CVE-2024-44410/): Command injection in dlink:di-8300 firmware (critical 9.8)
- [CVE-2024-4441](https://insights.sbomify.com/CVE-2024-4441/): XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion (high 8.1)
- [CVE-2024-44408](https://insights.sbomify.com/CVE-2024-44408/): Missing authorization in dlink:dir-823g firmware (high 7.5)
- [CVE-2024-44402](https://insights.sbomify.com/CVE-2024-44402/): Command injection in dlink:di-8100g firmware (critical 9.8)
- [CVE-2024-44401](https://insights.sbomify.com/CVE-2024-44401/): Command injection in dlink:di-8100g firmware (critical 9.8)
- [CVE-2024-44400](https://insights.sbomify.com/CVE-2024-44400/): Command injection in dlink:di-8400 firmware (high 8.0)
- [CVE-2024-4440](https://insights.sbomify.com/CVE-2024-4440/): Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (medium 6.4)
- [CVE-2024-44390](https://insights.sbomify.com/CVE-2024-44390/): Memory corruption in tenda:fh1206 firmware (high 8.0)
- [CVE-2024-4439](https://insights.sbomify.com/CVE-2024-4439/): Cross-site scripting in WordPress (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/273/