# Vulnerabilities published in 2024


- [CVE-2024-42624](https://insights.sbomify.com/CVE-2024-42624/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42623](https://insights.sbomify.com/CVE-2024-42623/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-42621](https://insights.sbomify.com/CVE-2024-42621/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-4262](https://insights.sbomify.com/CVE-2024-4262/): Cross-site scripting in Piotnet Addons For Elementor (medium 6.4)
- [CVE-2024-42619](https://insights.sbomify.com/CVE-2024-42619/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42618](https://insights.sbomify.com/CVE-2024-42618/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42617](https://insights.sbomify.com/CVE-2024-42617/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42616](https://insights.sbomify.com/CVE-2024-42616/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42613](https://insights.sbomify.com/CVE-2024-42613/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42612](https://insights.sbomify.com/CVE-2024-42612/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42611](https://insights.sbomify.com/CVE-2024-42611/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42610](https://insights.sbomify.com/CVE-2024-42610/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-4261](https://insights.sbomify.com/CVE-2024-4261/): Code injection in Lead Form Builder & Contact Form (medium 5.4)
- [CVE-2024-42609](https://insights.sbomify.com/CVE-2024-42609/): Cross-site request forgery in pligg:pligg cms (high 7.1)
- [CVE-2024-42608](https://insights.sbomify.com/CVE-2024-42608/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42607](https://insights.sbomify.com/CVE-2024-42607/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42606](https://insights.sbomify.com/CVE-2024-42606/): Cross-site request forgery in pligg:pligg cms (medium 5.7)
- [CVE-2024-42605](https://insights.sbomify.com/CVE-2024-42605/): Cross-site request forgery in pligg:pligg cms (high 7.1)
- [CVE-2024-42604](https://insights.sbomify.com/CVE-2024-42604/): Cross-site request forgery in pligg:pligg cms (high 8.8)
- [CVE-2024-42603](https://insights.sbomify.com/CVE-2024-42603/): Cross-site request forgery in pligg:pligg cms (medium 5.7)
- [CVE-2024-4260](https://insights.sbomify.com/CVE-2024-4260/): CoBlocks < 3.1.12 - Contributor+ SSRF (medium 6.5)
- [CVE-2024-42599](https://insights.sbomify.com/CVE-2024-42599/): Code injection in seacms:seacms (high 8.8)
- [CVE-2024-42598](https://insights.sbomify.com/CVE-2024-42598/): Code injection in seacms:seacms (medium 6.7)
- [CVE-2024-4259](https://insights.sbomify.com/CVE-2024-4259/): Sensetive Data Exposure in SAMPAS's AKOS (medium 6.9)
- [CVE-2024-42586](https://insights.sbomify.com/CVE-2024-42586/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42585](https://insights.sbomify.com/CVE-2024-42585/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42584](https://insights.sbomify.com/CVE-2024-42584/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42583](https://insights.sbomify.com/CVE-2024-42583/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42582](https://insights.sbomify.com/CVE-2024-42582/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42581](https://insights.sbomify.com/CVE-2024-42581/): Cross-site request forgery in siamonhasan:warehouse inventory system (critical 9.6)
- [CVE-2024-42580](https://insights.sbomify.com/CVE-2024-42580/): Cross-site request forgery in siamonhasan:warehouse inventory system (medium 5.7)
- [CVE-2024-4258](https://insights.sbomify.com/CVE-2024-4258/): Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-42579](https://insights.sbomify.com/CVE-2024-42579/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42578](https://insights.sbomify.com/CVE-2024-42578/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.0)
- [CVE-2024-42577](https://insights.sbomify.com/CVE-2024-42577/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42576](https://insights.sbomify.com/CVE-2024-42576/): Cross-site request forgery in siamonhasan:warehouse inventory system (high 8.8)
- [CVE-2024-42575](https://insights.sbomify.com/CVE-2024-42575/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42574](https://insights.sbomify.com/CVE-2024-42574/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42573](https://insights.sbomify.com/CVE-2024-42573/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42572](https://insights.sbomify.com/CVE-2024-42572/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42571](https://insights.sbomify.com/CVE-2024-42571/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42570](https://insights.sbomify.com/CVE-2024-42570/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-4257](https://insights.sbomify.com/CVE-2024-4257/): BlueNet Technology Clinical Browsing System deleteStudy.php sql injection (medium 6.3)
- [CVE-2024-42569](https://insights.sbomify.com/CVE-2024-42569/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42568](https://insights.sbomify.com/CVE-2024-42568/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42567](https://insights.sbomify.com/CVE-2024-42567/): SQL injection in arajajyothibabu:school management system (critical 9.8)
- [CVE-2024-42566](https://insights.sbomify.com/CVE-2024-42566/): SQL injection in arajajyothibabu:school management system (high 8.8)
- [CVE-2024-42565](https://insights.sbomify.com/CVE-2024-42565/): SQL injection in jerryhanjj:erp (critical 9.8)
- [CVE-2024-42564](https://insights.sbomify.com/CVE-2024-42564/): SQL injection in jerryhanjj:erp (high 7.6)
- [CVE-2024-42563](https://insights.sbomify.com/CVE-2024-42563/): File upload in jerryhanjj:erp (critical 9.8)
- [CVE-2024-42562](https://insights.sbomify.com/CVE-2024-42562/): SQL injection in krishna9772:pharmacy management system (critical 9.8)
- [CVE-2024-42561](https://insights.sbomify.com/CVE-2024-42561/): SQL injection in krishna9772:pharmacy management system (high 8.8)
- [CVE-2024-42560](https://insights.sbomify.com/CVE-2024-42560/): Cross-site scripting in varunsardana004:blood bank and donation management system (medium 6.1)
- [CVE-2024-4256](https://insights.sbomify.com/CVE-2024-4256/): Techkshetra Info Solutions Savsoft Quiz Category Page editCategory cross site scripting (low 2.4)
- [CVE-2024-42559](https://insights.sbomify.com/CVE-2024-42559/): An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid password. (critical 9.8)
- [CVE-2024-42558](https://insights.sbomify.com/CVE-2024-42558/): SQL injection in vaibhavverma9999:hotel management system (critical 9.8)
- [CVE-2024-42557](https://insights.sbomify.com/CVE-2024-42557/): Cross-site request forgery in vaibhavverma9999:hotel management system (high 8.8)
- [CVE-2024-42556](https://insights.sbomify.com/CVE-2024-42556/): SQL injection in vaibhavverma9999:hotel management system (critical 9.8)
- [CVE-2024-42555](https://insights.sbomify.com/CVE-2024-42555/): Cross-site request forgery in vaibhavverma9999:hotel management system (high 8.8)
- [CVE-2024-42554](https://insights.sbomify.com/CVE-2024-42554/): SQL injection in vaibhavverma9999:hotel management system (high 8.8)
- [CVE-2024-42553](https://insights.sbomify.com/CVE-2024-42553/): Cross-site request forgery in vaibhavverma9999:hotel management system (high 8.8)
- [CVE-2024-42552](https://insights.sbomify.com/CVE-2024-42552/): SQL injection in vaibhavverma9999:hotel management system (high 8.6)
- [CVE-2024-42550](https://insights.sbomify.com/CVE-2024-42550/): A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d a (medium 5.4)
- [CVE-2024-4255](https://insights.sbomify.com/CVE-2024-4255/): Ruijie RG-UAC gre_edit_commit.php os command injection (medium 4.7)
- [CVE-2024-42547](https://insights.sbomify.com/CVE-2024-42547/): Memory corruption in totolink:a3100r firmware (critical 9.8)
- [CVE-2024-42546](https://insights.sbomify.com/CVE-2024-42546/): Memory corruption in totolink:a3100r firmware (critical 9.8)
- [CVE-2024-42545](https://insights.sbomify.com/CVE-2024-42545/): Memory corruption in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-42543](https://insights.sbomify.com/CVE-2024-42543/): Memory corruption in totolink:a3700r firmware (high 8.8)
- [CVE-2024-4254](https://insights.sbomify.com/CVE-2024-4254/): Secrets Exfiltration in gradio-app/gradio (high 7.1)
- [CVE-2024-42533](https://insights.sbomify.com/CVE-2024-42533/): SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitra (critical 9.8)
- [CVE-2024-42531](https://insights.sbomify.com/CVE-2024-42531/): Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets (critical 9.8)
- [CVE-2024-4253](https://insights.sbomify.com/CVE-2024-4253/): Command Injection in gradio-app/gradio (high 7.5)
- [CVE-2024-42523](https://insights.sbomify.com/CVE-2024-42523/): File upload in publiccms:publiccms (high 7.2)
- [CVE-2024-42520](https://insights.sbomify.com/CVE-2024-42520/): Memory corruption in totolink:a3002r firmware (critical 9.8)
- [CVE-2024-4252](https://insights.sbomify.com/CVE-2024-4252/): Tenda i22 formSetUrlFilterRule stack-based overflow (high 8.8)
- [CVE-2024-42516](https://insights.sbomify.com/CVE-2024-42516/): Apache HTTP Server: HTTP response splitting (high 7.5)
- [CVE-2024-42515](https://insights.sbomify.com/CVE-2024-42515/): Glossarizer Cross-site Scripting vulnerability (critical 9.9)
- [CVE-2024-42514](https://insights.sbomify.com/CVE-2024-42514/): Missing authorization in mitel:micontact center business (high 8.1)
- [CVE-2024-42513](https://insights.sbomify.com/CVE-2024-42513/): Security Update for the OPC UA .NET Standard Stack (medium 5.3)
- [CVE-2024-42512](https://insights.sbomify.com/CVE-2024-42512/): Security Update for the OPC UA .NET Standard Stack (high 8.6)
- [CVE-2024-4251](https://insights.sbomify.com/CVE-2024-4251/): Tenda i21 DhcpSetSe fromDhcpSetSer stack-based overflow (high 8.8)
- [CVE-2024-42509](https://insights.sbomify.com/CVE-2024-42509/): Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2024-42508](https://insights.sbomify.com/CVE-2024-42508/): Information disclosure in HPE OneView (medium 5.5)
- [CVE-2024-42507](https://insights.sbomify.com/CVE-2024-42507/): Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2024-42506](https://insights.sbomify.com/CVE-2024-42506/): Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2024-42505](https://insights.sbomify.com/CVE-2024-42505/): Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2024-42504](https://insights.sbomify.com/CVE-2024-42504/): HPE IceWall Agent products, Cross-Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-42503](https://insights.sbomify.com/CVE-2024-42503/): Command injection in Aruba OS (high 7.2)
- [CVE-2024-42502](https://insights.sbomify.com/CVE-2024-42502/): Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface (high 7.2)
- [CVE-2024-42501](https://insights.sbomify.com/CVE-2024-42501/): Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE) (high 7.2)
- [CVE-2024-42500](https://insights.sbomify.com/CVE-2024-42500/): Denial of service in HPE HP-UX ONCplus (critical 9.3)
- [CVE-2024-4250](https://insights.sbomify.com/CVE-2024-4250/): Tenda i21 wifiSSIDset formwrlSSIDset stack-based overflow (high 8.8)
- [CVE-2024-42499](https://insights.sbomify.com/CVE-2024-42499/): FitNesse Path Traversal (medium 5.3)
- [CVE-2024-42497](https://insights.sbomify.com/CVE-2024-42497/): Insufficient permissions checks on teams (medium 6.0)
- [CVE-2024-42496](https://insights.sbomify.com/CVE-2024-42496/): Information disclosure in Smart-tab Android app (low 2.4)
- [CVE-2024-42495](https://insights.sbomify.com/CVE-2024-42495/): Hughes Network Systems WL3000 Missing Encryption of Sensitive Data (high 7.1)
- [CVE-2024-42494](https://insights.sbomify.com/CVE-2024-42494/): Ruijie Reyee OS Exposure of Private Personal Information to an Unauthorized Actor (high 7.1)
- [CVE-2024-42493](https://insights.sbomify.com/CVE-2024-42493/): Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized Actor (medium 6.9)
- [CVE-2024-42492](https://insights.sbomify.com/CVE-2024-42492/): Privilege escalation in BIOS and System Firmware Update Package for Intel(R) Server M50FCP family (medium 5.4)
- [CVE-2024-42491](https://insights.sbomify.com/CVE-2024-42491/): Null dereference in asterisk (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/289/