# Vulnerabilities published in 2024


- [CVE-2024-3234](https://insights.sbomify.com/CVE-2024-3234/): Path Traversal in gaizhenbiao/chuanhuchatgpt (critical 9.8)
- [CVE-2024-32339](https://insights.sbomify.com/CVE-2024-32339/): Cross-site scripting in wondercms:wondercms (medium 6.1)
- [CVE-2024-32338](https://insights.sbomify.com/CVE-2024-32338/): Cross-site scripting in wondercms:wondercms (medium 5.4)
- [CVE-2024-32337](https://insights.sbomify.com/CVE-2024-32337/): Cross-site scripting in wondercms:wondercms (medium 6.1)
- [CVE-2024-32335](https://insights.sbomify.com/CVE-2024-32335/): Cross-site scripting in totolink:n300rt firmware (medium 5.4)
- [CVE-2024-32334](https://insights.sbomify.com/CVE-2024-32334/): Cross-site scripting in totolink:n300rt firmware (medium 6.5)
- [CVE-2024-32333](https://insights.sbomify.com/CVE-2024-32333/): Cross-site scripting in totolink:n300rt firmware (medium 4.3)
- [CVE-2024-32332](https://insights.sbomify.com/CVE-2024-32332/): Cross-site scripting in totolink:n300rt firmware (medium 6.1)
- [CVE-2024-3233](https://insights.sbomify.com/CVE-2024-3233/): Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation (medium 4.3)
- [CVE-2024-32327](https://insights.sbomify.com/CVE-2024-32327/): Cross-site scripting in totolink:n300rt firmware (medium 5.5)
- [CVE-2024-32326](https://insights.sbomify.com/CVE-2024-32326/): Cross-site scripting in totolink:ex200 firmware (medium 6.8)
- [CVE-2024-32325](https://insights.sbomify.com/CVE-2024-32325/): Cross-site scripting in totolink:ex200 firmware (low 2.4)
- [CVE-2024-32324](https://insights.sbomify.com/CVE-2024-32324/): Memory corruption in szlbt:lbt-t300-t400 firmware (high 7.8)
- [CVE-2024-32323](https://insights.sbomify.com/CVE-2024-32323/): SQL Injection vulnerability in cnhcit.com Haichang OA v.1.0.0 allows a remote attacker to obtain sensitive information via the if parameter (high 8.1)
- [CVE-2024-32320](https://insights.sbomify.com/CVE-2024-32320/): Memory corruption in tenda:ac500 firmware (medium 5.9)
- [CVE-2024-3232](https://insights.sbomify.com/CVE-2024-3232/): Formula Injection Vulnerability (high 7.6)
- [CVE-2024-32318](https://insights.sbomify.com/CVE-2024-32318/): Memory corruption in tenda:ac500 firmware (critical 9.8)
- [CVE-2024-32317](https://insights.sbomify.com/CVE-2024-32317/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2024-32316](https://insights.sbomify.com/CVE-2024-32316/): Memory corruption in tenda:ac500 firmware (medium 6.5)
- [CVE-2024-32315](https://insights.sbomify.com/CVE-2024-32315/): Memory corruption in tenda:fh1202 firmware (medium 4.7)
- [CVE-2024-32314](https://insights.sbomify.com/CVE-2024-32314/): Command injection in tenda:ac500 firmware (low 3.8)
- [CVE-2024-32313](https://insights.sbomify.com/CVE-2024-32313/): Memory corruption in tenda:fh1205 firmware (medium 6.5)
- [CVE-2024-32312](https://insights.sbomify.com/CVE-2024-32312/): Memory corruption in tenda:f1203 firmware (medium 5.7)
- [CVE-2024-32311](https://insights.sbomify.com/CVE-2024-32311/): Memory corruption in tenda:fh1203 firmware (medium 6.5)
- [CVE-2024-32310](https://insights.sbomify.com/CVE-2024-32310/): Memory corruption in tenda:f1203 firmware (high 8.0)
- [CVE-2024-3231](https://insights.sbomify.com/CVE-2024-3231/): Popup4Phone <= 1.3.2 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-32307](https://insights.sbomify.com/CVE-2024-32307/): Memory corruption in tenda:fh1205 firmware (high 7.4)
- [CVE-2024-32306](https://insights.sbomify.com/CVE-2024-32306/): Memory corruption in tenda:ac10u firmware (medium 5.7)
- [CVE-2024-32305](https://insights.sbomify.com/CVE-2024-32305/): Memory corruption in tenda:a18 firmware (high 8.8)
- [CVE-2024-32303](https://insights.sbomify.com/CVE-2024-32303/): Memory corruption in tenda:ac15 firmware (high 8.0)
- [CVE-2024-32302](https://insights.sbomify.com/CVE-2024-32302/): Memory corruption in tenda:fh1202 firmware (medium 6.3)
- [CVE-2024-32301](https://insights.sbomify.com/CVE-2024-32301/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2024-3230](https://insights.sbomify.com/CVE-2024-3230/): Download Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-32299](https://insights.sbomify.com/CVE-2024-32299/): Memory corruption in tenda:fh1203 firmware (high 8.8)
- [CVE-2024-32293](https://insights.sbomify.com/CVE-2024-32293/): Memory corruption in tenda:w30e firmware (high 8.0)
- [CVE-2024-32292](https://insights.sbomify.com/CVE-2024-32292/): Command injection in tenda:w30e firmware (high 8.8)
- [CVE-2024-32291](https://insights.sbomify.com/CVE-2024-32291/): Memory corruption in tenda:w30e firmware (high 7.5)
- [CVE-2024-32290](https://insights.sbomify.com/CVE-2024-32290/): Memory corruption in tenda:w30e firmware (medium 6.7)
- [CVE-2024-3229](https://insights.sbomify.com/CVE-2024-3229/): Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-32288](https://insights.sbomify.com/CVE-2024-32288/): Memory corruption in tenda:w30e firmware (medium 6.3)
- [CVE-2024-32287](https://insights.sbomify.com/CVE-2024-32287/): Memory corruption in tenda:w30e firmware (medium 6.5)
- [CVE-2024-32286](https://insights.sbomify.com/CVE-2024-32286/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2024-32285](https://insights.sbomify.com/CVE-2024-32285/): Memory corruption in tenda:w30e firmware (high 8.0)
- [CVE-2024-32283](https://insights.sbomify.com/CVE-2024-32283/): Command injection in tenda:fh1203 firmware (high 7.3)
- [CVE-2024-32282](https://insights.sbomify.com/CVE-2024-32282/): Command injection in tenda:fh1202 firmware (medium 6.3)
- [CVE-2024-32281](https://insights.sbomify.com/CVE-2024-32281/): Command injection in tenda:ac7 firmware (high 8.8)
- [CVE-2024-3228](https://insights.sbomify.com/CVE-2024-3228/): Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure (medium 5.3)
- [CVE-2024-3227](https://insights.sbomify.com/CVE-2024-3227/): Panwei eoffice OA Backend save_image.php path traversal (medium 4.7)
- [CVE-2024-32269](https://insights.sbomify.com/CVE-2024-32269/): An issue in Yonganda YAD-LOJ V3.0.561 allows a remote attacker to cause a denial of service via a crafted packet. (high 7.5)
- [CVE-2024-32268](https://insights.sbomify.com/CVE-2024-32268/): An issue in Tuya Smart camera U6N v.3.2.5 allows a remote attacker to cause a denial of service via a crafted packet to the network connection component. (low 3.3)
- [CVE-2024-3226](https://insights.sbomify.com/CVE-2024-3226/): Campcodes Online Patient Record Management System login.php sql injection (high 7.3)
- [CVE-2024-32258](https://insights.sbomify.com/CVE-2024-32258/): The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake ROM. (high 8.8)
- [CVE-2024-32256](https://insights.sbomify.com/CVE-2024-32256/): File upload in phpgurukul:tourism management system (high 8.1)
- [CVE-2024-32254](https://insights.sbomify.com/CVE-2024-32254/): File upload in phpgurukul:tourism management system (high 8.8)
- [CVE-2024-3225](https://insights.sbomify.com/CVE-2024-3225/): SourceCodester PHP Task Management System edit-task.php sql injection (medium 6.3)
- [CVE-2024-3224](https://insights.sbomify.com/CVE-2024-3224/): SourceCodester PHP Task Management System task-details.php sql injection (medium 6.3)
- [CVE-2024-32238](https://insights.sbomify.com/CVE-2024-32238/): H3C ER8300G2-X is vulnerable to Incorrect Access Control. (critical 9.8)
- [CVE-2024-32236](https://insights.sbomify.com/CVE-2024-32236/): Information disclosure in cmseasy:cmseasy (low 3.5)
- [CVE-2024-32231](https://insights.sbomify.com/CVE-2024-32231/): SQL injection in github.com/stashapp/stash (medium 6.3)
- [CVE-2024-32230](https://insights.sbomify.com/CVE-2024-32230/): Memory corruption in ffmpeg:ffmpeg (high 7.8)
- [CVE-2024-3223](https://insights.sbomify.com/CVE-2024-3223/): SourceCodester PHP Task Management System admin-manage-user.php sql injection (medium 6.3)
- [CVE-2024-32229](https://insights.sbomify.com/CVE-2024-32229/): Memory corruption in ffmpeg:ffmpeg (high 8.4)
- [CVE-2024-32228](https://insights.sbomify.com/CVE-2024-32228/): Memory corruption in ffmpeg:ffmpeg (medium 6.6)
- [CVE-2024-3222](https://insights.sbomify.com/CVE-2024-3222/): SourceCodester PHP Task Management System admin-password-change.php sql injection (medium 6.3)
- [CVE-2024-32213](https://insights.sbomify.com/CVE-2024-32213/): Weak cryptography in logint:lomag warehouse management (medium 5.3)
- [CVE-2024-32212](https://insights.sbomify.com/CVE-2024-32212/): SQL injection in logint:lomag warehouse management (high 8.1)
- [CVE-2024-32211](https://insights.sbomify.com/CVE-2024-32211/): Information disclosure in logint:lomag warehouse management (medium 5.5)
- [CVE-2024-32210](https://insights.sbomify.com/CVE-2024-32210/): Hardcoded credentials in logint:lomag warehouse management (medium 5.3)
- [CVE-2024-3221](https://insights.sbomify.com/CVE-2024-3221/): SourceCodester PHP Task Management System attendance-info.php sql injection (medium 6.3)
- [CVE-2024-32206](https://insights.sbomify.com/CVE-2024-32206/): Cross-site scripting in wuzhicms:wuzhicms (medium 4.6)
- [CVE-2024-3220](https://insights.sbomify.com/CVE-2024-3220/): Default mimetype known files writeable on Windows (low 2.3)
- [CVE-2024-3219](https://insights.sbomify.com/CVE-2024-3219/): Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection (medium 5.1)
- [CVE-2024-3218](https://insights.sbomify.com/CVE-2024-3218/): Shibang Communications IP Network Intercom Broadcasting System busyscreenshotpush.php path traversal (medium 5.4)
- [CVE-2024-3217](https://insights.sbomify.com/CVE-2024-3217/): WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection (high 8.8)
- [CVE-2024-32167](https://insights.sbomify.com/CVE-2024-32167/): Path traversal in oretnom23:online medicine ordering system (critical 9.1)
- [CVE-2024-32166](https://insights.sbomify.com/CVE-2024-32166/): Missing authorization in webidsupport:webid (high 8.8)
- [CVE-2024-32163](https://insights.sbomify.com/CVE-2024-32163/): Path traversal in cmseasy:cmseasy (medium 6.4)
- [CVE-2024-32162](https://insights.sbomify.com/CVE-2024-32162/): Path traversal in cmseasy:cmseasy (medium 4.3)
- [CVE-2024-32161](https://insights.sbomify.com/CVE-2024-32161/): File upload in jizhicms:jizhicms (critical 9.8)
- [CVE-2024-3216](https://insights.sbomify.com/CVE-2024-3216/): Missing authorization in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels (medium 5.3)
- [CVE-2024-32152](https://insights.sbomify.com/CVE-2024-32152/): Ankitects Anki LaTeX Blocklist Bypass vulnerability (low 3.1)
- [CVE-2024-32151](https://insights.sbomify.com/CVE-2024-32151/): Information disclosure in Multiple MFPs (multifunction printers) (medium 5.9)
- [CVE-2024-3215](https://insights.sbomify.com/CVE-2024-3215/): Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery (medium 5.3)
- [CVE-2024-32149](https://insights.sbomify.com/CVE-2024-32149/): WordPress Jobs for WordPress plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32148](https://insights.sbomify.com/CVE-2024-32148/): WordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32147](https://insights.sbomify.com/CVE-2024-32147/): WordPress Contact Form Plugin plugin <= 1.1.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32146](https://insights.sbomify.com/CVE-2024-32146/): WordPress Aspose.Words – Import and Export word documents plugin <= 6.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32145](https://insights.sbomify.com/CVE-2024-32145/): Cross-site scripting in WP Google Analytics Events (high 7.1)
- [CVE-2024-32144](https://insights.sbomify.com/CVE-2024-32144/): WordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-32143](https://insights.sbomify.com/CVE-2024-32143/): WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32142](https://insights.sbomify.com/CVE-2024-32142/): WordPress Ovic Responsive WPBakery plugin <= 1.3.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-32141](https://insights.sbomify.com/CVE-2024-32141/): WordPress Libsyn Publisher Hub plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32140](https://insights.sbomify.com/CVE-2024-32140/): WordPress Libsyn Publisher Hub plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3214](https://insights.sbomify.com/CVE-2024-3214/): Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection (medium 5.8)
- [CVE-2024-32139](https://insights.sbomify.com/CVE-2024-32139/): WordPress Podlove Podcast Publisher plugin <= 4.0.12 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-32138](https://insights.sbomify.com/CVE-2024-32138/): WordPress Short URL plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32137](https://insights.sbomify.com/CVE-2024-32137/): WordPress User Activity Log Pro plugin <= 2.3.4 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-32136](https://insights.sbomify.com/CVE-2024-32136/): WordPress BWL Advanced FAQ Manager plugin <= 2.0.3 - Auth. SQL Injection vulnerability (high 7.6)
- [CVE-2024-32135](https://insights.sbomify.com/CVE-2024-32135/): WordPress Disable Comments | WPZest plugin <= 1.51 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-32134](https://insights.sbomify.com/CVE-2024-32134/): WordPress Forms to Zapier plugin <= 1.1.12 - Auth. SQL Injection vulnerability (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/371/