# Vulnerabilities published in 2024


- [CVE-2024-42787](https://insights.sbomify.com/CVE-2024-42787/): Cross-site scripting in lopalopa:music management system (medium 6.1)
- [CVE-2024-42786](https://insights.sbomify.com/CVE-2024-42786/): SQL injection in lopalopa:music management system (high 8.8)
- [CVE-2024-42785](https://insights.sbomify.com/CVE-2024-42785/): SQL injection in lopalopa:music management system (high 7.6)
- [CVE-2024-42784](https://insights.sbomify.com/CVE-2024-42784/): SQL injection in lopalopa:music management system (critical 9.8)
- [CVE-2024-42783](https://insights.sbomify.com/CVE-2024-42783/): SQL injection in lopalopa:music management system (medium 5.4)
- [CVE-2024-42782](https://insights.sbomify.com/CVE-2024-42782/): SQL injection in lopalopa:music management system (high 7.6)
- [CVE-2024-42781](https://insights.sbomify.com/CVE-2024-42781/): SQL injection in lopalopa:music management system (critical 9.8)
- [CVE-2024-42780](https://insights.sbomify.com/CVE-2024-42780/): File upload in lopalopa:music management system (high 8.8)
- [CVE-2024-4278](https://insights.sbomify.com/CVE-2024-4278/): Incorrect Synchronization in GitLab (medium 5.5)
- [CVE-2024-42779](https://insights.sbomify.com/CVE-2024-42779/): File upload in lopalopa:music management system (high 8.8)
- [CVE-2024-42778](https://insights.sbomify.com/CVE-2024-42778/): File upload in lopalopa:music management system (high 8.8)
- [CVE-2024-42777](https://insights.sbomify.com/CVE-2024-42777/): File upload in lopalopa:music management system (critical 9.8)
- [CVE-2024-42776](https://insights.sbomify.com/CVE-2024-42776/): Missing authorization in jayesh:hotel management system (high 7.2)
- [CVE-2024-42775](https://insights.sbomify.com/CVE-2024-42775/): Missing authorization in jayesh:hotel management system (critical 9.1)
- [CVE-2024-42774](https://insights.sbomify.com/CVE-2024-42774/): Missing authorization in jayesh:hotel management system (high 7.5)
- [CVE-2024-42773](https://insights.sbomify.com/CVE-2024-42773/): Missing authorization in jayesh:hotel management system (critical 9.1)
- [CVE-2024-42772](https://insights.sbomify.com/CVE-2024-42772/): Missing authorization in jayesh:hotel management system (high 7.5)
- [CVE-2024-42771](https://insights.sbomify.com/CVE-2024-42771/): Cross-site scripting in jayesh:hotel management system (medium 4.8)
- [CVE-2024-42770](https://insights.sbomify.com/CVE-2024-42770/): Cross-site scripting in jayesh:hotel management system (medium 4.7)
- [CVE-2024-4277](https://insights.sbomify.com/CVE-2024-4277/): Cross-site scripting in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (medium 6.4)
- [CVE-2024-42769](https://insights.sbomify.com/CVE-2024-42769/): Cross-site scripting in jayesh:hotel management system (medium 6.1)
- [CVE-2024-42768](https://insights.sbomify.com/CVE-2024-42768/): Cross-site request forgery in jayesh:hotel management system (medium 6.8)
- [CVE-2024-42767](https://insights.sbomify.com/CVE-2024-42767/): File upload in jayesh:hotel management system (high 7.2)
- [CVE-2024-42766](https://insights.sbomify.com/CVE-2024-42766/): Missing authorization in kjayvik:bus ticket reservation system (medium 5.4)
- [CVE-2024-42765](https://insights.sbomify.com/CVE-2024-42765/): SQL injection in kjayvik:bus ticket reservation system (critical 9.8)
- [CVE-2024-42764](https://insights.sbomify.com/CVE-2024-42764/): Cross-site request forgery in kjayvik:bus ticket reservation system (critical 9.4)
- [CVE-2024-42763](https://insights.sbomify.com/CVE-2024-42763/): Cross-site scripting in kjayvik:bus ticket reservation system (medium 5.4)
- [CVE-2024-42762](https://insights.sbomify.com/CVE-2024-42762/): Cross-site scripting in kjayvik:bus ticket reservation system (medium 5.4)
- [CVE-2024-42761](https://insights.sbomify.com/CVE-2024-42761/): Cross-site scripting in kjayvik:bus ticket reservation system (medium 6.1)
- [CVE-2024-42760](https://insights.sbomify.com/CVE-2024-42760/): SQL injection in ellevo:ellevo (high 7.5)
- [CVE-2024-42759](https://insights.sbomify.com/CVE-2024-42759/): Privilege escalation in ellevo:ellevo (medium 6.3)
- [CVE-2024-42758](https://insights.sbomify.com/CVE-2024-42758/): A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). (medium 5.4)
- [CVE-2024-42757](https://insights.sbomify.com/CVE-2024-42757/): Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page. (critical 9.8)
- [CVE-2024-42756](https://insights.sbomify.com/CVE-2024-42756/): Code injection in netgear:dgn1000ww firmware (high 8.8)
- [CVE-2024-4275](https://insights.sbomify.com/CVE-2024-4275/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-42749](https://insights.sbomify.com/CVE-2024-42749/): Cross-site scripting in altocms:alto cms (medium 6.1)
- [CVE-2024-42748](https://insights.sbomify.com/CVE-2024-42748/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2024-42747](https://insights.sbomify.com/CVE-2024-42747/): Command injection in totolink:x5000r firmware (high 7.3)
- [CVE-2024-42745](https://insights.sbomify.com/CVE-2024-42745/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2024-42744](https://insights.sbomify.com/CVE-2024-42744/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-42743](https://insights.sbomify.com/CVE-2024-42743/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-42742](https://insights.sbomify.com/CVE-2024-42742/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-42741](https://insights.sbomify.com/CVE-2024-42741/): Command injection in totolink:x5000r firmware (high 7.8)
- [CVE-2024-42740](https://insights.sbomify.com/CVE-2024-42740/): Command injection in totolink:x5000r firmware (medium 6.8)
- [CVE-2024-4274](https://insights.sbomify.com/CVE-2024-4274/): Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion (medium 4.3)
- [CVE-2024-42739](https://insights.sbomify.com/CVE-2024-42739/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-42738](https://insights.sbomify.com/CVE-2024-42738/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-42737](https://insights.sbomify.com/CVE-2024-42737/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2024-42736](https://insights.sbomify.com/CVE-2024-42736/): Command injection in totolink:x5000r firmware (high 7.8)
- [CVE-2024-42733](https://insights.sbomify.com/CVE-2024-42733/): Code injection in docmosis:tornado (critical 9.8)
- [CVE-2024-4273](https://insights.sbomify.com/CVE-2024-4273/): Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-4272](https://insights.sbomify.com/CVE-2024-4272/): Support SVG < 1.1.0 - Stored XSS via SVG Upload (medium 6.1)
- [CVE-2024-42718](https://insights.sbomify.com/CVE-2024-42718/): Croogo CMS has a path traversal vulnerability (medium 6.5)
- [CVE-2024-4271](https://insights.sbomify.com/CVE-2024-4271/): SVGator <= 1.2.6 - Stored XSS via SVG Upload (medium 4.6)
- [CVE-2024-4270](https://insights.sbomify.com/CVE-2024-4270/): SVGMagic <= 1.1 - Stored XSS via SVG Upload (medium 5.4)
- [CVE-2024-42699](https://insights.sbomify.com/CVE-2024-42699/): OpenCMS Cross-Site Scripting vulnerability (medium 6.5)
- [CVE-2024-42698](https://insights.sbomify.com/CVE-2024-42698/): Business logic in shedaniel:roughlyenoughitems (medium 4.3)
- [CVE-2024-42697](https://insights.sbomify.com/CVE-2024-42697/): Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary c (medium 6.1)
- [CVE-2024-4269](https://insights.sbomify.com/CVE-2024-4269/): SVG Block < 1.1.20 - Author+ Stored XSS via SVG File Upload (medium 6.1)
- [CVE-2024-42681](https://insights.sbomify.com/CVE-2024-42681/): Improper Preservation of Permissions in xxl-job (high 8.8)
- [CVE-2024-42680](https://insights.sbomify.com/CVE-2024-42680/): Information disclosure in cysoft168:super easy enterprise management system (medium 5.5)
- [CVE-2024-4268](https://insights.sbomify.com/CVE-2024-4268/): Cross-site scripting in Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor (medium 6.4)
- [CVE-2024-42679](https://insights.sbomify.com/CVE-2024-42679/): SQL injection in cysoft168:super easy enterprise management system (high 7.8)
- [CVE-2024-42678](https://insights.sbomify.com/CVE-2024-42678/): Cross-site scripting in cysoft168:super easy enterprise management system (medium 5.0)
- [CVE-2024-42677](https://insights.sbomify.com/CVE-2024-42677/): Information disclosure in isellerpal:enterprise resource management system (medium 5.5)
- [CVE-2024-42676](https://insights.sbomify.com/CVE-2024-42676/): File upload in isellerpal:enterprise resource management system (high 8.8)
- [CVE-2024-42671](https://insights.sbomify.com/CVE-2024-42671/): A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicio (medium 6.1)
- [CVE-2024-4267](https://insights.sbomify.com/CVE-2024-4267/): Remote Code Execution in parisneo/lollms-webui (high 8.4)
- [CVE-2024-42662](https://insights.sbomify.com/CVE-2024-42662/): Information disclosure in apolloconfig:apollo (high 7.5)
- [CVE-2024-4266](https://insights.sbomify.com/CVE-2024-4266/): Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 5.3)
- [CVE-2024-42658](https://insights.sbomify.com/CVE-2024-42658/): Information disclosure in nepstech:ntpl-xpon1gfevn firmware (high 8.8)
- [CVE-2024-42657](https://insights.sbomify.com/CVE-2024-42657/): Information disclosure in nepstech:ntpl-xpon1gfevn firmware (high 7.5)
- [CVE-2024-42655](https://insights.sbomify.com/CVE-2024-42655/): Auth bypass in emqx:nanomq (high 8.8)
- [CVE-2024-42651](https://insights.sbomify.com/CVE-2024-42651/): Use after free in emqx:nanomq (high 7.5)
- [CVE-2024-42650](https://insights.sbomify.com/CVE-2024-42650/): Denial of service in emqx:nanomq (high 7.5)
- [CVE-2024-4265](https://insights.sbomify.com/CVE-2024-4265/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 6.4)
- [CVE-2024-42649](https://insights.sbomify.com/CVE-2024-42649/): Denial of service in emqx:nanomq (medium 6.5)
- [CVE-2024-42648](https://insights.sbomify.com/CVE-2024-42648/): Memory corruption in emqx:nanomq (medium 6.5)
- [CVE-2024-42646](https://insights.sbomify.com/CVE-2024-42646/): Memory corruption in emqx:nanomq (high 7.5)
- [CVE-2024-42645](https://insights.sbomify.com/CVE-2024-42645/): Denial of service in flashmq:flashmq (high 7.5)
- [CVE-2024-42644](https://insights.sbomify.com/CVE-2024-42644/): Denial of service in flashmq:flashmq (high 7.5)
- [CVE-2024-42643](https://insights.sbomify.com/CVE-2024-42643/): Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access. (high 7.5)
- [CVE-2024-42642](https://insights.sbomify.com/CVE-2024-42642/): Memory corruption in crucial:mx500 firmware (medium 6.7)
- [CVE-2024-42640](https://insights.sbomify.com/CVE-2024-42640/): angular-base64-upload vulnerable to unauthenticated remote code execution (critical 9.8)
- [CVE-2024-4264](https://insights.sbomify.com/CVE-2024-4264/): Remote Code Execution in berriai/litellm (critical 9.8)
- [CVE-2024-42639](https://insights.sbomify.com/CVE-2024-42639/): Hardcoded credentials in h3c:gr1100-p firmware (critical 9.8)
- [CVE-2024-42638](https://insights.sbomify.com/CVE-2024-42638/): Hardcoded credentials in h3c:magic b1st firmware (critical 9.8)
- [CVE-2024-42637](https://insights.sbomify.com/CVE-2024-42637/): Hardcoded credentials in h3c:r3010 firmware (critical 9.8)
- [CVE-2024-42636](https://insights.sbomify.com/CVE-2024-42636/): Command injection in dedecms:dedecms (high 7.2)
- [CVE-2024-42634](https://insights.sbomify.com/CVE-2024-42634/): Command injection in tenda:ac9 firmware (critical 9.8)
- [CVE-2024-42633](https://insights.sbomify.com/CVE-2024-42633/): Command injection in linksys:e1500 firmware (high 8.0)
- [CVE-2024-42632](https://insights.sbomify.com/CVE-2024-42632/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42631](https://insights.sbomify.com/CVE-2024-42631/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42630](https://insights.sbomify.com/CVE-2024-42630/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-4263](https://insights.sbomify.com/CVE-2024-4263/): Improper Access Control in mlflow/mlflow (medium 5.4)
- [CVE-2024-42629](https://insights.sbomify.com/CVE-2024-42629/): Cross-site request forgery in frogcms project:frogcms (medium 5.4)
- [CVE-2024-42628](https://insights.sbomify.com/CVE-2024-42628/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42627](https://insights.sbomify.com/CVE-2024-42627/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42626](https://insights.sbomify.com/CVE-2024-42626/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42625](https://insights.sbomify.com/CVE-2024-42625/): Cross-site request forgery in frogcms project:frogcms (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/288/