# Vulnerabilities published in 2024


- [CVE-2024-3561](https://insights.sbomify.com/CVE-2024-3561/): Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field (high 8.8)
- [CVE-2024-3560](https://insights.sbomify.com/CVE-2024-3560/): LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-35595](https://insights.sbomify.com/CVE-2024-35595/): An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code (medium 6.1)
- [CVE-2024-35593](https://insights.sbomify.com/CVE-2024-35593/): An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uplo (medium 5.5)
- [CVE-2024-35592](https://insights.sbomify.com/CVE-2024-35592/): An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file. (critical 9.6)
- [CVE-2024-35591](https://insights.sbomify.com/CVE-2024-35591/): File upload in zoneland:o2oa (medium 5.4)
- [CVE-2024-3559](https://insights.sbomify.com/CVE-2024-3559/): Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content] (medium 6.4)
- [CVE-2024-35585](https://insights.sbomify.com/CVE-2024-35585/): Auth bypass in MinKNOW (high 8.6)
- [CVE-2024-35584](https://insights.sbomify.com/CVE-2024-35584/): SQL injection in os4ed:opensis (high 8.8)
- [CVE-2024-35583](https://insights.sbomify.com/CVE-2024-35583/): Cross-site scripting in oretnom23:computer laboratory management system (medium 6.1)
- [CVE-2024-35582](https://insights.sbomify.com/CVE-2024-35582/): Cross-site scripting in oretnom23:computer laboratory management system (medium 6.1)
- [CVE-2024-35581](https://insights.sbomify.com/CVE-2024-35581/): Cross-site scripting in oretnom23:computer laboratory management system (medium 6.1)
- [CVE-2024-35580](https://insights.sbomify.com/CVE-2024-35580/): Memory corruption in tenda:ax1806 firmware (critical 9.8)
- [CVE-2024-3558](https://insights.sbomify.com/CVE-2024-3558/): Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title] (medium 6.4)
- [CVE-2024-35579](https://insights.sbomify.com/CVE-2024-35579/): Memory corruption in tenda:ax1806 firmware (high 7.7)
- [CVE-2024-35578](https://insights.sbomify.com/CVE-2024-35578/): Memory corruption in tenda:ax1806 firmware (high 8.0)
- [CVE-2024-35576](https://insights.sbomify.com/CVE-2024-35576/): Memory corruption in tenda:ax1806 firmware (medium 5.2)
- [CVE-2024-35571](https://insights.sbomify.com/CVE-2024-35571/): Memory corruption in tenda:ax1806 firmware (critical 9.8)
- [CVE-2024-35570](https://insights.sbomify.com/CVE-2024-35570/): File upload in inxedu:inxedu (critical 9.8)
- [CVE-2024-3557](https://insights.sbomify.com/CVE-2024-3557/): WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-35563](https://insights.sbomify.com/CVE-2024-35563/): CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions. (critical 9.8)
- [CVE-2024-35561](https://insights.sbomify.com/CVE-2024-35561/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-35560](https://insights.sbomify.com/CVE-2024-35560/): Cross-site request forgery in idccms:idccms (medium 4.3)
- [CVE-2024-35559](https://insights.sbomify.com/CVE-2024-35559/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-35558](https://insights.sbomify.com/CVE-2024-35558/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-35557](https://insights.sbomify.com/CVE-2024-35557/): Cross-site request forgery in idccms:idccms (medium 5.5)
- [CVE-2024-35556](https://insights.sbomify.com/CVE-2024-35556/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-35555](https://insights.sbomify.com/CVE-2024-35555/): Cross-site request forgery in idccms:idccms (medium 6.3)
- [CVE-2024-35554](https://insights.sbomify.com/CVE-2024-35554/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-35553](https://insights.sbomify.com/CVE-2024-35553/): Cross-site request forgery in idccms:idccms (high 8.3)
- [CVE-2024-35552](https://insights.sbomify.com/CVE-2024-35552/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-35551](https://insights.sbomify.com/CVE-2024-35551/): Cross-site request forgery in idccms:idccms (medium 4.3)
- [CVE-2024-35550](https://insights.sbomify.com/CVE-2024-35550/): Cross-site request forgery in idccms:idccms (medium 6.3)
- [CVE-2024-3555](https://insights.sbomify.com/CVE-2024-3555/): Missing authorization in Social Link Pages: link-in-bio landing pages for your social media profiles (high 7.2)
- [CVE-2024-35548](https://insights.sbomify.com/CVE-2024-35548/): A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. (medium 5.4)
- [CVE-2024-35545](https://insights.sbomify.com/CVE-2024-35545/): Cross-site scripting in mapos:map-os (medium 6.1)
- [CVE-2024-35540](https://insights.sbomify.com/CVE-2024-35540/): Cross-site scripting in typecho:typecho (high 7.6)
- [CVE-2024-3554](https://insights.sbomify.com/CVE-2024-3554/): Cross-site scripting in All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic (medium 6.4)
- [CVE-2024-35539](https://insights.sbomify.com/CVE-2024-35539/): Race condition in typecho:typecho (medium 6.5)
- [CVE-2024-35538](https://insights.sbomify.com/CVE-2024-35538/): Security feature bypass in typecho:typecho (medium 5.3)
- [CVE-2024-35537](https://insights.sbomify.com/CVE-2024-35537/): Weak cryptography in tvsmotor:tvs connect (high 7.5)
- [CVE-2024-35532](https://insights.sbomify.com/CVE-2024-35532/): An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitr (critical 9.1)
- [CVE-2024-3553](https://insights.sbomify.com/CVE-2024-3553/): Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update (medium 6.5)
- [CVE-2024-35527](https://insights.sbomify.com/CVE-2024-35527/): An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers (critical 9.8)
- [CVE-2024-35526](https://insights.sbomify.com/CVE-2024-35526/): An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory. (medium 5.9)
- [CVE-2024-35522](https://insights.sbomify.com/CVE-2024-35522/): Command injection in netgear:ex3700 firmware (high 8.4)
- [CVE-2024-35520](https://insights.sbomify.com/CVE-2024-35520/): Command injection in netgear:r7000 firmware (high 8.4)
- [CVE-2024-3552](https://insights.sbomify.com/CVE-2024-3552/): Web Directory Free < 1.7.0 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-35519](https://insights.sbomify.com/CVE-2024-35519/): Command injection in netgear:ex3700 firmware (high 8.4)
- [CVE-2024-35518](https://insights.sbomify.com/CVE-2024-35518/): Command injection in netgear:ex6120 firmware (high 8.4)
- [CVE-2024-35517](https://insights.sbomify.com/CVE-2024-35517/): Command injection in netgear:xr1000 firmware (high 8.4)
- [CVE-2024-35515](https://insights.sbomify.com/CVE-2024-35515/): sqlitedict insecure deserialization vulnerability (critical 9.8)
- [CVE-2024-35512](https://insights.sbomify.com/CVE-2024-35512/): hmq v1.5.5 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. (medium 5.3)
- [CVE-2024-35511](https://insights.sbomify.com/CVE-2024-35511/): SQL injection in phpgurukul:men salon management system (medium 4.7)
- [CVE-2024-35510](https://insights.sbomify.com/CVE-2024-35510/): File upload in dedecms:dedecms (critical 9.8)
- [CVE-2024-3551](https://insights.sbomify.com/CVE-2024-3551/): Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-35504](https://insights.sbomify.com/CVE-2024-35504/): Cross-site scripting in finesoft project:finesoft (medium 5.4)
- [CVE-2024-3550](https://insights.sbomify.com/CVE-2024-3550/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)
- [CVE-2024-35498](https://insights.sbomify.com/CVE-2024-35498/): Grav Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-35495](https://insights.sbomify.com/CVE-2024-35495/): An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.14394 (medium 4.3)
- [CVE-2024-35492](https://insights.sbomify.com/CVE-2024-35492/): Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. (high 7.5)
- [CVE-2024-3549](https://insights.sbomify.com/CVE-2024-3549/): Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection (critical 9.9)
- [CVE-2024-3548](https://insights.sbomify.com/CVE-2024-3548/): Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-35475](https://insights.sbomify.com/CVE-2024-35475/): Cross-site request forgery in openkm:openkm (medium 6.4)
- [CVE-2024-35474](https://insights.sbomify.com/CVE-2024-35474/): A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, (medium 6.5)
- [CVE-2024-3547](https://insights.sbomify.com/CVE-2024-3547/): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-35469](https://insights.sbomify.com/CVE-2024-35469/): SQL injection in oretnom23:human resource management system (critical 9.8)
- [CVE-2024-35468](https://insights.sbomify.com/CVE-2024-35468/): SQL injection in oretnom23:human resource management system (medium 5.4)
- [CVE-2024-3546](https://insights.sbomify.com/CVE-2024-3546/): WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal (medium 4.3)
- [CVE-2024-35451](https://insights.sbomify.com/CVE-2024-35451/): Server-side request forgery in linkstack:linkstack (medium 4.8)
- [CVE-2024-3545](https://insights.sbomify.com/CVE-2024-3545/): Information disclosure in Remote Desktop Manager (medium 4.3)
- [CVE-2024-3544](https://insights.sbomify.com/CVE-2024-3544/): LoadMaster Hardcoded SSH Key (high 7.5)
- [CVE-2024-35434](https://insights.sbomify.com/CVE-2024-35434/): Memory corruption in irontec:sngrep (high 7.5)
- [CVE-2024-35433](https://insights.sbomify.com/CVE-2024-35433/): Missing authorization in zkteco:zkbio cvsecurity (high 8.1)
- [CVE-2024-35432](https://insights.sbomify.com/CVE-2024-35432/): Cross-site scripting in zkteco:zkbio cvsecurity (medium 6.1)
- [CVE-2024-35431](https://insights.sbomify.com/CVE-2024-35431/): Path traversal in zkteco:zkbio cvsecurity (high 7.5)
- [CVE-2024-35430](https://insights.sbomify.com/CVE-2024-35430/): Auth bypass in zkteco:zkbio cvsecurity (high 8.1)
- [CVE-2024-3543](https://insights.sbomify.com/CVE-2024-3543/): LoadMaster Reversible Password Encryption Algorithm (medium 6.4)
- [CVE-2024-35429](https://insights.sbomify.com/CVE-2024-35429/): Path traversal in zkteco:zkbio cvsecurity (medium 6.5)
- [CVE-2024-35428](https://insights.sbomify.com/CVE-2024-35428/): Path traversal in zkteco:zkbio cvsecurity (high 7.1)
- [CVE-2024-35427](https://insights.sbomify.com/CVE-2024-35427/): Denial of service in lonelycoder:vmir (medium 5.5)
- [CVE-2024-35426](https://insights.sbomify.com/CVE-2024-35426/): Memory corruption in lonelycoder:vmir (critical 9.8)
- [CVE-2024-35425](https://insights.sbomify.com/CVE-2024-35425/): Memory corruption in lonelycoder:vmir (medium 5.5)
- [CVE-2024-35424](https://insights.sbomify.com/CVE-2024-35424/): Denial of service in lonelycoder:vmir (medium 5.5)
- [CVE-2024-35423](https://insights.sbomify.com/CVE-2024-35423/): Memory corruption in lonelycoder:vmir (high 7.8)
- [CVE-2024-35422](https://insights.sbomify.com/CVE-2024-35422/): Memory corruption in lonelycoder:vmir (high 7.8)
- [CVE-2024-35421](https://insights.sbomify.com/CVE-2024-35421/): Denial of service in lonelycoder:vmir (medium 5.5)
- [CVE-2024-35420](https://insights.sbomify.com/CVE-2024-35420/): Memory corruption in kanaka:wac (medium 6.2)
- [CVE-2024-3542](https://insights.sbomify.com/CVE-2024-3542/): Campcodes Church Management System add_visitor.php cross site scripting (low 3.5)
- [CVE-2024-35419](https://insights.sbomify.com/CVE-2024-35419/): Memory corruption in kanaka:wac (medium 5.5)
- [CVE-2024-35418](https://insights.sbomify.com/CVE-2024-35418/): Memory corruption in kanaka:wac (medium 6.2)
- [CVE-2024-35410](https://insights.sbomify.com/CVE-2024-35410/): Memory corruption in kanaka:wac (medium 6.2)
- [CVE-2024-3541](https://insights.sbomify.com/CVE-2024-3541/): Campcodes Church Management System admin_user.php cross site scripting (low 3.5)
- [CVE-2024-35409](https://insights.sbomify.com/CVE-2024-35409/): SQL injection in webidsupport:webid (critical 9.8)
- [CVE-2024-35403](https://insights.sbomify.com/CVE-2024-35403/): Memory corruption in totolink:cp900l firmware (low 2.7)
- [CVE-2024-35401](https://insights.sbomify.com/CVE-2024-35401/): Command injection in totolink:cp900l firmware (medium 5.9)
- [CVE-2024-35400](https://insights.sbomify.com/CVE-2024-35400/): Memory corruption in totolink:cp900l firmware (medium 5.3)
- [CVE-2024-3540](https://insights.sbomify.com/CVE-2024-3540/): Campcodes Church Management System add_sundaysch.php sql injection (medium 6.3)
- [CVE-2024-35399](https://insights.sbomify.com/CVE-2024-35399/): Memory corruption in totolink:cp900l firmware (high 8.8)
- [CVE-2024-35398](https://insights.sbomify.com/CVE-2024-35398/): Memory corruption in totolink:cp900l firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/346/