# Vulnerabilities published in 2024


- [CVE-2024-3359](https://insights.sbomify.com/CVE-2024-3359/): SourceCodester Online Library System login.php sql injection (high 7.3)
- [CVE-2024-33589](https://insights.sbomify.com/CVE-2024-33589/): WordPress KB Support plugin <= 1.6.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-33588](https://insights.sbomify.com/CVE-2024-33588/): WordPress basepress plugin <= 2.16.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-33587](https://insights.sbomify.com/CVE-2024-33587/): WordPress Secure Copy Content Protection and Content Locking plugin <= 3.9.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33586](https://insights.sbomify.com/CVE-2024-33586/): WordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33585](https://insights.sbomify.com/CVE-2024-33585/): Missing authorization in Payment Gateway Based Fees and Discounts for WooCommerce (medium 4.3)
- [CVE-2024-33584](https://insights.sbomify.com/CVE-2024-33584/): WordPress Video Conferencing with Zoom plugin <= 4.4.4 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-33583](https://insights.sbomify.com/CVE-2024-33583/): Misconfiguration in SIMATIC RTLS Locating Manager (medium 4.8)
- [CVE-2024-33582](https://insights.sbomify.com/CVE-2024-33582/): Privilege escalation in Service Framework (high 7.8)
- [CVE-2024-33581](https://insights.sbomify.com/CVE-2024-33581/): Privilege escalation in PC Manager AI intelligent scenario (high 7.8)
- [CVE-2024-33580](https://insights.sbomify.com/CVE-2024-33580/): Privilege escalation in Personal Cloud (high 7.8)
- [CVE-2024-3358](https://insights.sbomify.com/CVE-2024-3358/): SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scripting (low 3.5)
- [CVE-2024-33579](https://insights.sbomify.com/CVE-2024-33579/): Privilege escalation in Baiying (high 7.8)
- [CVE-2024-33578](https://insights.sbomify.com/CVE-2024-33578/): Privilege escalation in Leyun (high 7.8)
- [CVE-2024-33577](https://insights.sbomify.com/CVE-2024-33577/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-33576](https://insights.sbomify.com/CVE-2024-33576/): WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-33575](https://insights.sbomify.com/CVE-2024-33575/): WordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-33574](https://insights.sbomify.com/CVE-2024-33574/): WordPress Vitepos plugin <= 3.0.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33573](https://insights.sbomify.com/CVE-2024-33573/): WordPress EPROLO Dropshipping plugin <= 1.7.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33572](https://insights.sbomify.com/CVE-2024-33572/): WordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33571](https://insights.sbomify.com/CVE-2024-33571/): WordPress VOD Infomaniak plugin <= 1.5.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33570](https://insights.sbomify.com/CVE-2024-33570/): WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-3357](https://insights.sbomify.com/CVE-2024-3357/): SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scripting (low 3.5)
- [CVE-2024-33569](https://insights.sbomify.com/CVE-2024-33569/): WordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability (high 7.2)
- [CVE-2024-33568](https://insights.sbomify.com/CVE-2024-33568/): WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability (high 8.5)
- [CVE-2024-33567](https://insights.sbomify.com/CVE-2024-33567/): Privilege escalation in Barcode Scanner with Inventory & Order Manager (critical 9.8)
- [CVE-2024-33566](https://insights.sbomify.com/CVE-2024-33566/): WordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-33565](https://insights.sbomify.com/CVE-2024-33565/): Missing authorization in Barcode Scanner with Inventory & Order Manager (critical 9.1)
- [CVE-2024-33564](https://insights.sbomify.com/CVE-2024-33564/): WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability (high 8.8)
- [CVE-2024-33563](https://insights.sbomify.com/CVE-2024-33563/): WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability (high 7.6)
- [CVE-2024-33562](https://insights.sbomify.com/CVE-2024-33562/): WordPress XStore theme <= 9.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33561](https://insights.sbomify.com/CVE-2024-33561/): WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability (high 7.5)
- [CVE-2024-33560](https://insights.sbomify.com/CVE-2024-33560/): WordPress XStore theme <= 9.3.8 - Unauthenticated Local File Inclusion vulnerability (critical 9.0)
- [CVE-2024-3356](https://insights.sbomify.com/CVE-2024-3356/): SourceCodester Aplaya Beach Resort Online Reservation System sql injection (high 7.3)
- [CVE-2024-33559](https://insights.sbomify.com/CVE-2024-33559/): WordPress XStore theme <= 9.3.5 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-33558](https://insights.sbomify.com/CVE-2024-33558/): WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2024-33557](https://insights.sbomify.com/CVE-2024-33557/): WordPress XStore Core plugin <= 5.3.8 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-33556](https://insights.sbomify.com/CVE-2024-33556/): WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability (high 8.2)
- [CVE-2024-33555](https://insights.sbomify.com/CVE-2024-33555/): WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability (high 8.1)
- [CVE-2024-33554](https://insights.sbomify.com/CVE-2024-33554/): WordPress XStore Core plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33553](https://insights.sbomify.com/CVE-2024-33553/): WordPress XStore Core plugin <= 5.3.5 - Unauthenticated PHP Object Injection vulnerability (critical 9.0)
- [CVE-2024-33552](https://insights.sbomify.com/CVE-2024-33552/): WordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2024-33551](https://insights.sbomify.com/CVE-2024-33551/): WordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-33550](https://insights.sbomify.com/CVE-2024-33550/): WordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerability (high 8.8)
- [CVE-2024-3355](https://insights.sbomify.com/CVE-2024-3355/): SourceCodester Aplaya Beach Resort Online Reservation System sql injection (high 7.3)
- [CVE-2024-33549](https://insights.sbomify.com/CVE-2024-33549/): WordPress WZone plugin <= 14.0.10 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-33548](https://insights.sbomify.com/CVE-2024-33548/): WordPress WZone plugin <= 14.0.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33547](https://insights.sbomify.com/CVE-2024-33547/): WordPress WZone plugin <= 14.0.10 - Site Wide Broken Access Control vulnerability (high 8.3)
- [CVE-2024-33546](https://insights.sbomify.com/CVE-2024-33546/): WordPress WZone plugin <= 14.0.10 - Arbitrary SQL Update Execution vulnerability (critical 9.6)
- [CVE-2024-33545](https://insights.sbomify.com/CVE-2024-33545/): WordPress WZone plugin <= 14.0.10 - Unauthenticated Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33544](https://insights.sbomify.com/CVE-2024-33544/): WordPress WZone plugin <= 14.0.10 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-33543](https://insights.sbomify.com/CVE-2024-33543/): WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-33542](https://insights.sbomify.com/CVE-2024-33542/): WordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2024-33541](https://insights.sbomify.com/CVE-2024-33541/): WordPress Better Elementor Addons plugin <= 1.4.1 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-33540](https://insights.sbomify.com/CVE-2024-33540/): WordPress ColorNews theme <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3354](https://insights.sbomify.com/CVE-2024-3354/): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (high 7.3)
- [CVE-2024-33539](https://insights.sbomify.com/CVE-2024-33539/): WordPress WPZOOM Addons for Elementor plugin <= 1.1.35 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33538](https://insights.sbomify.com/CVE-2024-33538/): WordPress Assistant – Every Day Productivity Apps plugin <= 1.4.9.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-33537](https://insights.sbomify.com/CVE-2024-33537/): WordPress WP Portfolio theme <= 2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33536](https://insights.sbomify.com/CVE-2024-33536/): Cross-site scripting in zimbra:collaboration (medium 5.4)
- [CVE-2024-33535](https://insights.sbomify.com/CVE-2024-33535/): Path traversal in zimbra:collaboration (high 7.5)
- [CVE-2024-33533](https://insights.sbomify.com/CVE-2024-33533/): Cross-site scripting in zimbra:collaboration (medium 5.4)
- [CVE-2024-33531](https://insights.sbomify.com/CVE-2024-33531/): cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. (high 8.1)
- [CVE-2024-33530](https://insights.sbomify.com/CVE-2024-33530/): In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeti (high 7.5)
- [CVE-2024-3353](https://insights.sbomify.com/CVE-2024-3353/): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (high 7.3)
- [CVE-2024-33529](https://insights.sbomify.com/CVE-2024-33529/): Command injection in ilias:ilias (high 7.2)
- [CVE-2024-33528](https://insights.sbomify.com/CVE-2024-33528/): Cross-site scripting in ilias:ilias (medium 4.7)
- [CVE-2024-33527](https://insights.sbomify.com/CVE-2024-33527/): Cross-site scripting in ilias:ilias (medium 5.4)
- [CVE-2024-33526](https://insights.sbomify.com/CVE-2024-33526/): Cross-site scripting in ilias:ilias (high 7.1)
- [CVE-2024-33525](https://insights.sbomify.com/CVE-2024-33525/): A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS (medium 4.3)
- [CVE-2024-33522](https://insights.sbomify.com/CVE-2024-33522/): Privilege escalation in Calico CNI install binary (medium 6.7)
- [CVE-2024-3352](https://insights.sbomify.com/CVE-2024-3352/): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (high 7.3)
- [CVE-2024-33519](https://insights.sbomify.com/CVE-2024-33519/): Authenticated Server-Side prototype pollution Leading to Information Disclosure (high 7.2)
- [CVE-2024-33518](https://insights.sbomify.com/CVE-2024-33518/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.3)
- [CVE-2024-33517](https://insights.sbomify.com/CVE-2024-33517/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.3)
- [CVE-2024-33516](https://insights.sbomify.com/CVE-2024-33516/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.3)
- [CVE-2024-33515](https://insights.sbomify.com/CVE-2024-33515/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.3)
- [CVE-2024-33514](https://insights.sbomify.com/CVE-2024-33514/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.3)
- [CVE-2024-33513](https://insights.sbomify.com/CVE-2024-33513/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.9)
- [CVE-2024-33512](https://insights.sbomify.com/CVE-2024-33512/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (critical 9.8)
- [CVE-2024-33511](https://insights.sbomify.com/CVE-2024-33511/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (critical 9.8)
- [CVE-2024-33510](https://insights.sbomify.com/CVE-2024-33510/): Other in FortiOS (low 3.6)
- [CVE-2024-3351](https://insights.sbomify.com/CVE-2024-3351/): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (high 7.3)
- [CVE-2024-33509](https://insights.sbomify.com/CVE-2024-33509/): Security feature bypass in FortiWeb (medium 4.4)
- [CVE-2024-33508](https://insights.sbomify.com/CVE-2024-33508/): Command injection in FortiClientEMS (medium 6.9)
- [CVE-2024-33507](https://insights.sbomify.com/CVE-2024-33507/): Auth bypass in FortiIsolator (high 7.0)
- [CVE-2024-33506](https://insights.sbomify.com/CVE-2024-33506/): Information disclosure in FortiManager (low 3.1)
- [CVE-2024-33505](https://insights.sbomify.com/CVE-2024-33505/): Memory corruption in FortiAnalyzer (medium 5.3)
- [CVE-2024-33504](https://insights.sbomify.com/CVE-2024-33504/): Hardcoded credentials in FortiManager (low 3.9)
- [CVE-2024-33503](https://insights.sbomify.com/CVE-2024-33503/): Privilege escalation in FortiManager (medium 6.7)
- [CVE-2024-33502](https://insights.sbomify.com/CVE-2024-33502/): Path traversal in FortiAnalyzer (medium 6.4)
- [CVE-2024-33501](https://insights.sbomify.com/CVE-2024-33501/): SQL injection in FortiManager (medium 4.0)
- [CVE-2024-33500](https://insights.sbomify.com/CVE-2024-33500/): Privilege escalation in Mendix Applications using Mendix 10 (high 7.4)
- [CVE-2024-3350](https://insights.sbomify.com/CVE-2024-3350/): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (high 7.3)
- [CVE-2024-33499](https://insights.sbomify.com/CVE-2024-33499/): Privilege escalation in SIMATIC RTLS Locating Manager (critical 9.4)
- [CVE-2024-33498](https://insights.sbomify.com/CVE-2024-33498/): Denial of service in SIMATIC RTLS Locating Manager (medium 6.9)
- [CVE-2024-33497](https://insights.sbomify.com/CVE-2024-33497/): Information disclosure in SIMATIC RTLS Locating Manager (medium 4.8)
- [CVE-2024-33496](https://insights.sbomify.com/CVE-2024-33496/): Information disclosure in SIMATIC RTLS Locating Manager (medium 4.8)
- [CVE-2024-33495](https://insights.sbomify.com/CVE-2024-33495/): Denial of service in SIMATIC RTLS Locating Manager (high 7.1)
- [CVE-2024-33494](https://insights.sbomify.com/CVE-2024-33494/): Auth bypass in SIMATIC RTLS Locating Manager (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/361/