# Vulnerabilities published in 2024


- [CVE-2024-37858](https://insights.sbomify.com/CVE-2024-37858/): SQL injection in oretnom23:lost and found information system (critical 9.8)
- [CVE-2024-37857](https://insights.sbomify.com/CVE-2024-37857/): SQL injection in oretnom23:lost and found information system (high 8.8)
- [CVE-2024-37856](https://insights.sbomify.com/CVE-2024-37856/): Cross-site scripting in oretnom23:lost and found information system (medium 5.4)
- [CVE-2024-37855](https://insights.sbomify.com/CVE-2024-37855/): An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute a (high 8.4)
- [CVE-2024-3785](https://insights.sbomify.com/CVE-2024-3785/): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (medium 6.6)
- [CVE-2024-37849](https://insights.sbomify.com/CVE-2024-37849/): SQL injection in itsourcecode:billing system (critical 9.8)
- [CVE-2024-37848](https://insights.sbomify.com/CVE-2024-37848/): SQL injection in angeljudesuarez:online book store project (high 8.4)
- [CVE-2024-37847](https://insights.sbomify.com/CVE-2024-37847/): File upload in radixiot:mango (critical 9.8)
- [CVE-2024-37846](https://insights.sbomify.com/CVE-2024-37846/): Code injection in radixiot:mango (critical 9.8)
- [CVE-2024-37845](https://insights.sbomify.com/CVE-2024-37845/): Command injection in radixiot:mango (high 7.2)
- [CVE-2024-37844](https://insights.sbomify.com/CVE-2024-37844/): Cross-site scripting in radixiot:mango (medium 4.7)
- [CVE-2024-37843](https://insights.sbomify.com/CVE-2024-37843/): Craft CMS SQL injection vulnerability via the GraphQL API endpoint (high 7.5)
- [CVE-2024-37840](https://insights.sbomify.com/CVE-2024-37840/): SQL injection in itsourcecode:learning management system (high 8.8)
- [CVE-2024-3784](https://insights.sbomify.com/CVE-2024-3784/): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (medium 6.6)
- [CVE-2024-37831](https://insights.sbomify.com/CVE-2024-37831/): SQL injection in itsourcecode:payroll management system (critical 9.1)
- [CVE-2024-37830](https://insights.sbomify.com/CVE-2024-37830/): Open redirect in getoutline:outline (medium 4.3)
- [CVE-2024-3783](https://insights.sbomify.com/CVE-2024-3783/): Path Traversal vulnerability in WBSAirback (high 7.7)
- [CVE-2024-37829](https://insights.sbomify.com/CVE-2024-37829/): Auth bypass in getoutline:outline (high 8.8)
- [CVE-2024-37828](https://insights.sbomify.com/CVE-2024-37828/): A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted (medium 4.8)
- [CVE-2024-37826](https://insights.sbomify.com/CVE-2024-37826/): Null dereference in vercot:serva (high 7.5)
- [CVE-2024-37825](https://insights.sbomify.com/CVE-2024-37825/): An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthen (medium 5.4)
- [CVE-2024-37821](https://insights.sbomify.com/CVE-2024-37821/): Dolibarr arbitrary file upload vulnerability (high 8.8)
- [CVE-2024-37820](https://insights.sbomify.com/CVE-2024-37820/): PingCAP TiDB nil pointer dereference (medium 5.4)
- [CVE-2024-3782](https://insights.sbomify.com/CVE-2024-3782/): Cross-Site Request Forgery (CSRF) vulnerability in WBSAirback (high 8.8)
- [CVE-2024-37818](https://insights.sbomify.com/CVE-2024-37818/): Strapi Server-Side Request Forgery (SSRF) (high 8.6)
- [CVE-2024-37816](https://insights.sbomify.com/CVE-2024-37816/): Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow. (medium 4.2)
- [CVE-2024-3781](https://insights.sbomify.com/CVE-2024-3781/): OS Command Injection vulnerability in WBSAirback (critical 9.1)
- [CVE-2024-37803](https://insights.sbomify.com/CVE-2024-37803/): Cross-site scripting in health care hospital management system project:health care hospital management system (medium 5.4)
- [CVE-2024-37802](https://insights.sbomify.com/CVE-2024-37802/): SQL injection in health care hospital management system project:health care hospital management system (critical 9.4)
- [CVE-2024-37800](https://insights.sbomify.com/CVE-2024-37800/): Cross-site scripting in code-projects:restaurant reservation system (medium 6.1)
- [CVE-2024-3780](https://insights.sbomify.com/CVE-2024-3780/): Information exposure vulnerability on Technicolor CGA2121 (high 7.8)
- [CVE-2024-37799](https://insights.sbomify.com/CVE-2024-37799/): SQL injection in code-projects:restaurant reservation system (medium 5.4)
- [CVE-2024-37798](https://insights.sbomify.com/CVE-2024-37798/): Cross-site scripting in phpgurukul:beauty parlour management system (medium 5.9)
- [CVE-2024-37795](https://insights.sbomify.com/CVE-2024-37795/): A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing t (high 7.5)
- [CVE-2024-37794](https://insights.sbomify.com/CVE-2024-37794/): Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. (high 7.5)
- [CVE-2024-37791](https://insights.sbomify.com/CVE-2024-37791/): DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id. (medium 6.0)
- [CVE-2024-3779](https://insights.sbomify.com/CVE-2024-3779/): Denial of Service in ESET products for Windows (medium 6.1)
- [CVE-2024-37783](https://insights.sbomify.com/CVE-2024-37783/): A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScri (medium 6.1)
- [CVE-2024-37782](https://insights.sbomify.com/CVE-2024-37782/): An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or exe (critical 9.8)
- [CVE-2024-3778](https://insights.sbomify.com/CVE-2024-3778/): Ai3 QbiBot - Unrestricted File Upload (high 7.2)
- [CVE-2024-37779](https://insights.sbomify.com/CVE-2024-37779/): WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. (high 8.8)
- [CVE-2024-37777](https://insights.sbomify.com/CVE-2024-37777/): Code injection in zoneland:o2oa (high 8.8)
- [CVE-2024-37776](https://insights.sbomify.com/CVE-2024-37776/): Cross-site scripting in sunbirddcim:dctrack (medium 4.8)
- [CVE-2024-37775](https://insights.sbomify.com/CVE-2024-37775/): Missing authorization in sunbirddcim:dctrack (high 7.5)
- [CVE-2024-37774](https://insights.sbomify.com/CVE-2024-37774/): Cross-site request forgery in sunbirddcim:dctrack (high 8.0)
- [CVE-2024-37773](https://insights.sbomify.com/CVE-2024-37773/): Cross-site scripting in sunbirddcim:dctrack (medium 4.8)
- [CVE-2024-37770](https://insights.sbomify.com/CVE-2024-37770/): Code injection in b1ackc4t:14finger (critical 9.1)
- [CVE-2024-3777](https://insights.sbomify.com/CVE-2024-3777/): Ai3 QbiBot - Broken Access Control (critical 9.8)
- [CVE-2024-37769](https://insights.sbomify.com/CVE-2024-37769/): Privilege escalation in b1ackc4t:14finger (high 8.8)
- [CVE-2024-37768](https://insights.sbomify.com/CVE-2024-37768/): Missing authorization in b1ackc4t:14finger (critical 9.1)
- [CVE-2024-37767](https://insights.sbomify.com/CVE-2024-37767/): Missing authorization in b1ackc4t:14finger (high 7.5)
- [CVE-2024-37765](https://insights.sbomify.com/CVE-2024-37765/): SQL injection in machform:machform (high 8.8)
- [CVE-2024-37764](https://insights.sbomify.com/CVE-2024-37764/): Cross-site scripting in machform:machform (medium 5.4)
- [CVE-2024-37763](https://insights.sbomify.com/CVE-2024-37763/): Cross-site scripting in machform:machform (medium 5.4)
- [CVE-2024-37762](https://insights.sbomify.com/CVE-2024-37762/): File upload in machform:machform (critical 9.9)
- [CVE-2024-3776](https://insights.sbomify.com/CVE-2024-3776/): Netvision airPASS - Reflected XSS (medium 6.1)
- [CVE-2024-37759](https://insights.sbomify.com/CVE-2024-37759/): Code injection in datagear:datagear (critical 9.8)
- [CVE-2024-37758](https://insights.sbomify.com/CVE-2024-37758/): Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privileges. (high 8.8)
- [CVE-2024-3775](https://insights.sbomify.com/CVE-2024-3775/): aEnrich Technology a+HRD - Argument Injection (medium 5.3)
- [CVE-2024-37743](https://insights.sbomify.com/CVE-2024-37743/): Code injection in mmz-001:knowledgegpt (critical 9.8)
- [CVE-2024-37742](https://insights.sbomify.com/CVE-2024-37742/): Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. (high 8.2)
- [CVE-2024-37741](https://insights.sbomify.com/CVE-2024-37741/): Cross-site scripting in openplcproject:openplc v3 firmware (medium 5.4)
- [CVE-2024-3774](https://insights.sbomify.com/CVE-2024-3774/): aEnrich Technology a+HRD - Exposure of Sensitive Data (medium 5.3)
- [CVE-2024-37734](https://insights.sbomify.com/CVE-2024-37734/): Privilege escalation in open-emr:openemr (critical 9.8)
- [CVE-2024-37732](https://insights.sbomify.com/CVE-2024-37732/): Cross-site scripting in anchorcms:anchor cms (high 8.8)
- [CVE-2024-3773](https://insights.sbomify.com/CVE-2024-3773/): LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode (medium 5.9)
- [CVE-2024-37728](https://insights.sbomify.com/CVE-2024-37728/): Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attack (high 7.5)
- [CVE-2024-37726](https://insights.sbomify.com/CVE-2024-37726/): Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges (medium 6.8)
- [CVE-2024-3772](https://insights.sbomify.com/CVE-2024-3772/): Regular expression denial of service in Pydantic < 2.4.0 (medium 5.9)
- [CVE-2024-3771](https://insights.sbomify.com/CVE-2024-3771/): PHPGurukul Student Record System edit-subject.php sql injection (medium 6.3)
- [CVE-2024-3770](https://insights.sbomify.com/CVE-2024-3770/): PHPGurukul Student Record System sql injection (medium 6.3)
- [CVE-2024-37699](https://insights.sbomify.com/CVE-2024-37699/): An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. (critical 9.8)
- [CVE-2024-3769](https://insights.sbomify.com/CVE-2024-3769/): PHPGurukul Student Record System login.php sql injection (high 7.3)
- [CVE-2024-37681](https://insights.sbomify.com/CVE-2024-37681/): An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a deni (medium 6.5)
- [CVE-2024-37680](https://insights.sbomify.com/CVE-2024-37680/): Cross-site scripting in finesoft project:finesoft (medium 6.3)
- [CVE-2024-3768](https://insights.sbomify.com/CVE-2024-3768/): PHPGurukul/itsourcecode News Portal search.php sql injection (medium 5.3)
- [CVE-2024-37679](https://insights.sbomify.com/CVE-2024-37679/): Cross-site scripting in finesoft project:finesoft (medium 6.1)
- [CVE-2024-37678](https://insights.sbomify.com/CVE-2024-37678/): Cross-site scripting in finesoft project:finesoft (medium 5.3)
- [CVE-2024-37677](https://insights.sbomify.com/CVE-2024-37677/): Missing authorization in access management specialist project:access management specialist (high 7.5)
- [CVE-2024-37676](https://insights.sbomify.com/CVE-2024-37676/): An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function. (high 8.4)
- [CVE-2024-37675](https://insights.sbomify.com/CVE-2024-37675/): Cross-site scripting in tessi:docubase (medium 5.4)
- [CVE-2024-37674](https://insights.sbomify.com/CVE-2024-37674/): Cross-site scripting in moodle:moodle (medium 5.5)
- [CVE-2024-37673](https://insights.sbomify.com/CVE-2024-37673/): Cross-site scripting in tessi:docubase (medium 5.4)
- [CVE-2024-37672](https://insights.sbomify.com/CVE-2024-37672/): Cross-site scripting in tessi:docubase (medium 5.4)
- [CVE-2024-37671](https://insights.sbomify.com/CVE-2024-37671/): Cross-site scripting in tessi:docubase (medium 5.4)
- [CVE-2024-3767](https://insights.sbomify.com/CVE-2024-3767/): PHPGurukul News Portal edit-post.php sql injection (medium 5.3)
- [CVE-2024-37665](https://insights.sbomify.com/CVE-2024-37665/): Privilege escalation in wvp-pro:gb28181 (high 8.8)
- [CVE-2024-37664](https://insights.sbomify.com/CVE-2024-37664/): Denial of service in mi:redmi ax6s firmware (medium 5.2)
- [CVE-2024-37663](https://insights.sbomify.com/CVE-2024-37663/): Other in mi:redmi ax6s firmware (medium 4.1)
- [CVE-2024-37662](https://insights.sbomify.com/CVE-2024-37662/): Denial of service in tp-link:tl-7dr5130 firmware (medium 6.3)
- [CVE-2024-37661](https://insights.sbomify.com/CVE-2024-37661/): Security feature bypass in tp-link:tl-7dr5130 firmware (medium 6.3)
- [CVE-2024-3766](https://insights.sbomify.com/CVE-2024-3766/): slowlyo OwlAdmin Image File Upload upload_image cross site scripting (low 2.4)
- [CVE-2024-37658](https://insights.sbomify.com/CVE-2024-37658/): Open redirect in sir:gnuboard (medium 6.1)
- [CVE-2024-37657](https://insights.sbomify.com/CVE-2024-37657/): Open redirect in sir:gnuboard (medium 6.1)
- [CVE-2024-37656](https://insights.sbomify.com/CVE-2024-37656/): Open redirect in sir:gnuboard (medium 6.1)
- [CVE-2024-37654](https://insights.sbomify.com/CVE-2024-37654/): An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, (medium 6.1)
- [CVE-2024-3765](https://insights.sbomify.com/CVE-2024-3765/): Xiongmai AHB7804R-MH-V2 Sofia Service access control (critical 9.8)
- [CVE-2024-37649](https://insights.sbomify.com/CVE-2024-37649/): Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obt (medium 4.6)
- [CVE-2024-37645](https://insights.sbomify.com/CVE-2024-37645/): Memory corruption in trendnet:tew-814dap firmware (high 8.8)
- [CVE-2024-37644](https://insights.sbomify.com/CVE-2024-37644/): Hardcoded credentials in trendnet:tew-814dap firmware (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/327/