# Vulnerabilities published in 2024


- [CVE-2024-34949](https://insights.sbomify.com/CVE-2024-34949/): SQL injection in likeshop:likeshop (high 8.2)
- [CVE-2024-34948](https://insights.sbomify.com/CVE-2024-34948/): An issue in Quanxun Huiju Network Technology(Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 allows attackers to cause a Denial of Se (high 7.5)
- [CVE-2024-34947](https://insights.sbomify.com/CVE-2024-34947/): Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack. (critical 9.4)
- [CVE-2024-34946](https://insights.sbomify.com/CVE-2024-34946/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-34945](https://insights.sbomify.com/CVE-2024-34945/): Memory corruption in tenda:fh1206 firmware (critical 9.8)
- [CVE-2024-34944](https://insights.sbomify.com/CVE-2024-34944/): Memory corruption in tenda:fh1206 firmware (high 8.8)
- [CVE-2024-34943](https://insights.sbomify.com/CVE-2024-34943/): Memory corruption in tenda:fh1206 firmware (critical 9.8)
- [CVE-2024-34942](https://insights.sbomify.com/CVE-2024-34942/): Memory corruption in tenda:fh1206 firmware (high 8.8)
- [CVE-2024-3494](https://insights.sbomify.com/CVE-2024-3494/): Cross-site scripting in Mesmerize Companion (medium 6.4)
- [CVE-2024-34936](https://insights.sbomify.com/CVE-2024-34936/): SQL injection in campcodes:complete web-based school management system (high 8.6)
- [CVE-2024-34935](https://insights.sbomify.com/CVE-2024-34935/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-34934](https://insights.sbomify.com/CVE-2024-34934/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-34933](https://insights.sbomify.com/CVE-2024-34933/): SQL injection in campcodes:complete web-based school management system (medium 6.3)
- [CVE-2024-34932](https://insights.sbomify.com/CVE-2024-34932/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-34931](https://insights.sbomify.com/CVE-2024-34931/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-34930](https://insights.sbomify.com/CVE-2024-34930/): SQL injection in campcodes:complete web-based school management system (medium 5.3)
- [CVE-2024-3493](https://insights.sbomify.com/CVE-2024-3493/): Rockwell Automation ControlLogix and GaurdLogix Vulnerable to Major Nonrecoverable Fault Due to Invalid Header Value (high 8.6)
- [CVE-2024-34929](https://insights.sbomify.com/CVE-2024-34929/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-34928](https://insights.sbomify.com/CVE-2024-34928/): SQL injection in campcodes:complete web-based school management system (high 7.3)
- [CVE-2024-34927](https://insights.sbomify.com/CVE-2024-34927/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-34923](https://insights.sbomify.com/CVE-2024-34923/): In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there (medium 6.1)
- [CVE-2024-34921](https://insights.sbomify.com/CVE-2024-34921/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-3492](https://insights.sbomify.com/CVE-2024-3492/): Cross-site scripting in Events Manager – Calendar, Bookings, Tickets, and more! (medium 6.4)
- [CVE-2024-34919](https://insights.sbomify.com/CVE-2024-34919/): An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 al (critical 9.8)
- [CVE-2024-34914](https://insights.sbomify.com/CVE-2024-34914/): PHP Censor uses a weak hashing algorithm for the remember me key (medium 5.3)
- [CVE-2024-34913](https://insights.sbomify.com/CVE-2024-34913/): File upload in technocking:r-pan-scaffolding (medium 5.4)
- [CVE-2024-3491](https://insights.sbomify.com/CVE-2024-3491/): Cross-site scripting in Schema & Structured Data for WP & AMP (medium 6.4)
- [CVE-2024-34909](https://insights.sbomify.com/CVE-2024-34909/): File upload in kykms:kykms (critical 9.8)
- [CVE-2024-34906](https://insights.sbomify.com/CVE-2024-34906/): File upload in dootask:dootask (medium 6.3)
- [CVE-2024-34905](https://insights.sbomify.com/CVE-2024-34905/): Memory corruption in cloudwise:flyfish (high 7.5)
- [CVE-2024-3490](https://insights.sbomify.com/CVE-2024-3490/): Cross-site scripting in WP Recipe Maker (medium 6.4)
- [CVE-2024-34899](https://insights.sbomify.com/CVE-2024-34899/): AVideo cross-site scripting vulnerability in the view/about.php page (medium 5.4)
- [CVE-2024-34897](https://insights.sbomify.com/CVE-2024-34897/): Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability. (high 7.5)
- [CVE-2024-34896](https://insights.sbomify.com/CVE-2024-34896/): An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer- (high 7.5)
- [CVE-2024-34891](https://insights.sbomify.com/CVE-2024-34891/): Information disclosure in bitrix24:bitrix24 (medium 6.8)
- [CVE-2024-3489](https://insights.sbomify.com/CVE-2024-3489/): Cross-site scripting in Exclusive Addons for Elementor (medium 6.4)
- [CVE-2024-34887](https://insights.sbomify.com/CVE-2024-34887/): Information disclosure in bitrix24:bitrix24 (medium 6.8)
- [CVE-2024-34885](https://insights.sbomify.com/CVE-2024-34885/): Information disclosure in bitrix24:bitrix24 (medium 6.8)
- [CVE-2024-34883](https://insights.sbomify.com/CVE-2024-34883/): Information disclosure in bitrix24:bitrix24 (medium 6.8)
- [CVE-2024-34882](https://insights.sbomify.com/CVE-2024-34882/): Information disclosure in bitrix24:bitrix24 (medium 6.8)
- [CVE-2024-3488](https://insights.sbomify.com/CVE-2024-3488/): File Upload vulnerability in unauthenticated session found in iManager. (medium 5.6)
- [CVE-2024-3487](https://insights.sbomify.com/CVE-2024-3487/): Broken Authentication vulnerability in iManager (low 3.5)
- [CVE-2024-3486](https://insights.sbomify.com/CVE-2024-3486/): XML External Entity injection vulnerability in iManager (high 7.8)
- [CVE-2024-34854](https://insights.sbomify.com/CVE-2024-34854/): File upload in f-logic:datacube3 firmware (critical 9.8)
- [CVE-2024-34852](https://insights.sbomify.com/CVE-2024-34852/): Command injection in f-logic:datacube3 firmware (medium 6.3)
- [CVE-2024-3485](https://insights.sbomify.com/CVE-2024-3485/): Server-Side Request Forgery vulnerability in iManager (medium 5.3)
- [CVE-2024-3484](https://insights.sbomify.com/CVE-2024-3484/): Path Traversal vulnerability found in iManager (medium 5.7)
- [CVE-2024-34833](https://insights.sbomify.com/CVE-2024-34833/): File upload in oretnom23:payroll management system (critical 9.8)
- [CVE-2024-34832](https://insights.sbomify.com/CVE-2024-34832/): Path traversal in cubecart:cubecart (critical 9.8)
- [CVE-2024-34831](https://insights.sbomify.com/CVE-2024-34831/): Cross-site scripting in gibbonedu:gibbon (medium 6.1)
- [CVE-2024-3483](https://insights.sbomify.com/CVE-2024-3483/): Remote Code Execution vulnerability in the iManager (high 7.8)
- [CVE-2024-34828](https://insights.sbomify.com/CVE-2024-34828/): WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34827](https://insights.sbomify.com/CVE-2024-34827/): Cross-site request forgery in TranslatePress (medium 4.3)
- [CVE-2024-34826](https://insights.sbomify.com/CVE-2024-34826/): WordPress CF7 WOW Styler plugin <= 1.6.4 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-34825](https://insights.sbomify.com/CVE-2024-34825/): WordPress Social Warfare plugin <= 4.4.5.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34824](https://insights.sbomify.com/CVE-2024-34824/): WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-34823](https://insights.sbomify.com/CVE-2024-34823/): WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34822](https://insights.sbomify.com/CVE-2024-34822/): WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34821](https://insights.sbomify.com/CVE-2024-34821/): WordPress Contact List plugin <= 2.9.87 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34820](https://insights.sbomify.com/CVE-2024-34820/): WordPress If-So Dynamic Content Personalization plugin <= 1.7.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-3482](https://insights.sbomify.com/CVE-2024-3482/): OpenText ArcSight Enterprise Security Manager and ArcSight Platform Stored XSS (high 8.7)
- [CVE-2024-34819](https://insights.sbomify.com/CVE-2024-34819/): WordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34818](https://insights.sbomify.com/CVE-2024-34818/): WordPress Webinar plugin <= 1.33.17 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2024-34817](https://insights.sbomify.com/CVE-2024-34817/): Cross-site request forgery in Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms (medium 4.3)
- [CVE-2024-34816](https://insights.sbomify.com/CVE-2024-34816/): WordPress WPCal.io plugin <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-34815](https://insights.sbomify.com/CVE-2024-34815/): WordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-34814](https://insights.sbomify.com/CVE-2024-34814/): WordPress Unyson plugin <=2.7.29 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-34813](https://insights.sbomify.com/CVE-2024-34813/): WordPress WooCommerce Wishlist plugin <= 1.7.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34812](https://insights.sbomify.com/CVE-2024-34812/): WordPress ShopBuilder plugin <= 2.1.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-34811](https://insights.sbomify.com/CVE-2024-34811/): WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34810](https://insights.sbomify.com/CVE-2024-34810/): WordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3481](https://insights.sbomify.com/CVE-2024-3481/): Counter Box < 1.2.4 - Counter Deletion via CSRF (medium 5.2)
- [CVE-2024-34809](https://insights.sbomify.com/CVE-2024-34809/): WordPress EmpowerWP theme <= 1.0.21 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34808](https://insights.sbomify.com/CVE-2024-34808/): WordPress JCH Optimize plugin <= 4.2.0 - Path Traversal vulnerability (medium 4.3)
- [CVE-2024-34807](https://insights.sbomify.com/CVE-2024-34807/): WordPress Fast Custom Social Share by CodeBard plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34806](https://insights.sbomify.com/CVE-2024-34806/): WordPress Clearfy Cache plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34805](https://insights.sbomify.com/CVE-2024-34805/): WordPress iframe plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34804](https://insights.sbomify.com/CVE-2024-34804/): WordPress Tagembed plugin <= 5.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-34803](https://insights.sbomify.com/CVE-2024-34803/): WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-34802](https://insights.sbomify.com/CVE-2024-34802/): WordPress AdFoxly plugin <= 1.8.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34801](https://insights.sbomify.com/CVE-2024-34801/): WordPress Praison SEO WordPress plugin <= 4.0.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34800](https://insights.sbomify.com/CVE-2024-34800/): WordPress Crafthemes Demo Import plugin <= 3.3 - Arbitrary plugin Installation vulnerability (high 7.6)
- [CVE-2024-3480](https://insights.sbomify.com/CVE-2024-3480/): Information disclosure in Phones (low 2.8)
- [CVE-2024-34799](https://insights.sbomify.com/CVE-2024-34799/): WordPress BookingPress plugin <= 1.0.82 - Appointment Duration Manipulation vulnerability (medium 6.5)
- [CVE-2024-34798](https://insights.sbomify.com/CVE-2024-34798/): WordPress Debug Log – Manger Tool plugin <= 1.4.5 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-34797](https://insights.sbomify.com/CVE-2024-34797/): WordPress Simple Popup Manager plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34796](https://insights.sbomify.com/CVE-2024-34796/): WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34795](https://insights.sbomify.com/CVE-2024-34795/): WordPress Tainacan plugin <= 0.21.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34794](https://insights.sbomify.com/CVE-2024-34794/): WordPress Tainacan plugin <= 0.21.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-34793](https://insights.sbomify.com/CVE-2024-34793/): WordPress WP Next Post Navi plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34792](https://insights.sbomify.com/CVE-2024-34792/): WordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-34791](https://insights.sbomify.com/CVE-2024-34791/): WordPress WPB Elementor Addons plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34790](https://insights.sbomify.com/CVE-2024-34790/): WordPress Download ImageMagick Sharpen Resized Images plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3479](https://insights.sbomify.com/CVE-2024-3479/): Information disclosure in Phones (low 2.8)
- [CVE-2024-34789](https://insights.sbomify.com/CVE-2024-34789/): WordPress Post Grid Elementor Addon plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34788](https://insights.sbomify.com/CVE-2024-34788/): Auth bypass in EPMM (medium 5.3)
- [CVE-2024-34787](https://insights.sbomify.com/CVE-2024-34787/): Path traversal in EPM (high 7.8)
- [CVE-2024-34786](https://insights.sbomify.com/CVE-2024-34786/): Misconfiguration in UniFi iOS App (medium 4.8)
- [CVE-2024-34785](https://insights.sbomify.com/CVE-2024-34785/): SQL injection in EPM (critical 9.1)
- [CVE-2024-34784](https://insights.sbomify.com/CVE-2024-34784/): SQL injection in EPM (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/350/