# Vulnerabilities published in 2024


- [CVE-2024-31117](https://insights.sbomify.com/CVE-2024-31117/): WordPress WooCommerce Bookings Calendar plugin <= 1.0.36 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31116](https://insights.sbomify.com/CVE-2024-31116/): WordPress 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-31115](https://insights.sbomify.com/CVE-2024-31115/): WordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-31114](https://insights.sbomify.com/CVE-2024-31114/): WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-31113](https://insights.sbomify.com/CVE-2024-31113/): WordPress Easy Digital Downloads plugin <= 3.2.11 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31112](https://insights.sbomify.com/CVE-2024-31112/): WordPress Convert Post Types plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31111](https://insights.sbomify.com/CVE-2024-31111/): WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31110](https://insights.sbomify.com/CVE-2024-31110/): WordPress Contact Form 7 Newsletter plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3111](https://insights.sbomify.com/CVE-2024-3111/): H5P < 1.15.8 - Contributor+ Stored XSS (high 7.1)
- [CVE-2024-31109](https://insights.sbomify.com/CVE-2024-31109/): WordPress Woocommerce Social Media Share Buttons plugin <= 1.3.0 - CSRF to Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31108](https://insights.sbomify.com/CVE-2024-31108/): WordPress iFlyChat plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31107](https://insights.sbomify.com/CVE-2024-31107/): WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31106](https://insights.sbomify.com/CVE-2024-31106/): WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31105](https://insights.sbomify.com/CVE-2024-31105/): WordPress Tax Rate Upload plugin <= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31104](https://insights.sbomify.com/CVE-2024-31104/): WordPress GetResponse for WordPress plugin <= 5.5.33 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31103](https://insights.sbomify.com/CVE-2024-31103/): WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31102](https://insights.sbomify.com/CVE-2024-31102/): WordPress Prenotazioni plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31101](https://insights.sbomify.com/CVE-2024-31101/): WordPress AI Twitter Feeds (Twitter widget & shortcode) plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31100](https://insights.sbomify.com/CVE-2024-31100/): WordPress Popup Cart Lite for WooCommerce plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-3110](https://insights.sbomify.com/CVE-2024-3110/): Stored XSS leading to admin account takeover in mintplex-labs/anything-llm (high 7.3)
- [CVE-2024-31099](https://insights.sbomify.com/CVE-2024-31099/): WordPress Phlox Core Elements plugin <= 2.15.7 - Broken Access Control vulnerability (medium 6.4)
- [CVE-2024-31098](https://insights.sbomify.com/CVE-2024-31098/): WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-31097](https://insights.sbomify.com/CVE-2024-31097/): WordPress SEO Title Tag plugin <= 3.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31096](https://insights.sbomify.com/CVE-2024-31096/): WordPress Nictitate theme <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31095](https://insights.sbomify.com/CVE-2024-31095/): WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-31094](https://insights.sbomify.com/CVE-2024-31094/): WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - PHP Object Injection vulnerability (high 8.5)
- [CVE-2024-31093](https://insights.sbomify.com/CVE-2024-31093/): WordPress Broken Images plugin <= 0.2 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-31092](https://insights.sbomify.com/CVE-2024-31092/): WordPress Comic Easel plugin <= 1.15 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31091](https://insights.sbomify.com/CVE-2024-31091/): WordPress Custom Field Bulk Editor plugin <= 1.9.1 - Cross Site Scripting vulnerability (high 7.1)
- [CVE-2024-31090](https://insights.sbomify.com/CVE-2024-31090/): WordPress Hacklog Down As PDF plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3109](https://insights.sbomify.com/CVE-2024-3109/): Hardcoded credentials in Phones (medium 6.3)
- [CVE-2024-31089](https://insights.sbomify.com/CVE-2024-31089/): WordPress Platinum SEO plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31088](https://insights.sbomify.com/CVE-2024-31088/): WordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31087](https://insights.sbomify.com/CVE-2024-31087/): WordPress pageMash plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31086](https://insights.sbomify.com/CVE-2024-31086/): WordPress Change default login logo,url and title plugin <= 2.0 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-31085](https://insights.sbomify.com/CVE-2024-31085/): WordPress Post-Plugin Library plugin <= 2.6.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31084](https://insights.sbomify.com/CVE-2024-31084/): WordPress Weekly Class Schedule plugin <= 3.19 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31083](https://insights.sbomify.com/CVE-2024-31083/): Xorg-x11-server: use-after-free in procrenderaddglyphs (high 7.8)
- [CVE-2024-31082](https://insights.sbomify.com/CVE-2024-31082/): Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap (high 7.3)
- [CVE-2024-31081](https://insights.sbomify.com/CVE-2024-31081/): Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice (high 7.3)
- [CVE-2024-31080](https://insights.sbomify.com/CVE-2024-31080/): Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents (high 7.3)
- [CVE-2024-3108](https://insights.sbomify.com/CVE-2024-3108/): Information disclosure in Phones (medium 5.5)
- [CVE-2024-31079](https://insights.sbomify.com/CVE-2024-31079/): NGINX HTTP/3 QUIC vulnerability (medium 4.8)
- [CVE-2024-31078](https://insights.sbomify.com/CVE-2024-31078/): Bluetooth Service has a use after free vulnerability (low 3.3)
- [CVE-2024-31077](https://insights.sbomify.com/CVE-2024-31077/): SQL injection in Forminator (high 7.2)
- [CVE-2024-31076](https://insights.sbomify.com/CVE-2024-31076/): genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (medium 5.5)
- [CVE-2024-31074](https://insights.sbomify.com/CVE-2024-31074/): Information disclosure in Intel(R) QAT Engine for OpenSSL software (high 8.2)
- [CVE-2024-31073](https://insights.sbomify.com/CVE-2024-31073/): Privilege escalation in Intel(R) oneAPI Level Zero software (medium 5.4)
- [CVE-2024-31071](https://insights.sbomify.com/CVE-2024-31071/): Arkcompiler Ets Runtime has a type confusion vulnerability (low 3.3)
- [CVE-2024-31070](https://insights.sbomify.com/CVE-2024-31070/): Misconfiguration in FutureNet NXR-120/C (critical 9.1)
- [CVE-2024-3107](https://insights.sbomify.com/CVE-2024-3107/): Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal (medium 4.3)
- [CVE-2024-31069](https://insights.sbomify.com/CVE-2024-31069/): IOSIX IO-1020 Micro ELD Use of Default Credentials (high 7.4)
- [CVE-2024-31068](https://insights.sbomify.com/CVE-2024-31068/): Denial of service in Intel(R) Processors (medium 5.6)
- [CVE-2024-31065](https://insights.sbomify.com/CVE-2024-31065/): Cross-site scripting in munyweki:insurance management system (medium 6.1)
- [CVE-2024-31064](https://insights.sbomify.com/CVE-2024-31064/): Cross-site scripting in munyweki:insurance management system (medium 6.1)
- [CVE-2024-31063](https://insights.sbomify.com/CVE-2024-31063/): Cross-site scripting in munyweki:insurance management system (medium 6.4)
- [CVE-2024-31062](https://insights.sbomify.com/CVE-2024-31062/): Cross-site scripting in munyweki:insurance management system (medium 6.3)
- [CVE-2024-31061](https://insights.sbomify.com/CVE-2024-31061/): Cross-site scripting in munyweki:insurance management system (medium 6.1)
- [CVE-2024-3105](https://insights.sbomify.com/CVE-2024-3105/): Code injection in Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (critical 9.9)
- [CVE-2024-31047](https://insights.sbomify.com/CVE-2024-31047/): Integer overflow in openexr:openexr (low 3.3)
- [CVE-2024-31041](https://insights.sbomify.com/CVE-2024-31041/): Null dereference in emqx:nanomq (high 7.5)
- [CVE-2024-31040](https://insights.sbomify.com/CVE-2024-31040/): Memory corruption in emqx:nanomq (low 2.7)
- [CVE-2024-3104](https://insights.sbomify.com/CVE-2024-3104/): Remote Code Execution in mintplex-labs/anything-llm (critical 9.6)
- [CVE-2024-31036](https://insights.sbomify.com/CVE-2024-31036/): Memory corruption in emqx:nanomq (medium 6.8)
- [CVE-2024-31033](https://insights.sbomify.com/CVE-2024-31033/): JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. (medium 6.8)
- [CVE-2024-31032](https://insights.sbomify.com/CVE-2024-31032/): An issue in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport v.1.1.2 allows a remote attacker to execute arbitra (critical 9.8)
- [CVE-2024-31031](https://insights.sbomify.com/CVE-2024-31031/): Integer overflow in fedoraproject:fedora (high 7.5)
- [CVE-2024-31030](https://insights.sbomify.com/CVE-2024-31030/): Null dereference in keith-cullen:freecoap (critical 9.1)
- [CVE-2024-31029](https://insights.sbomify.com/CVE-2024-31029/): Memory corruption in keith-cullen:freecoap (high 8.2)
- [CVE-2024-31027](https://insights.sbomify.com/CVE-2024-31027/): Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arb (medium 5.4)
- [CVE-2024-31026](https://insights.sbomify.com/CVE-2024-31026/): An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat i (critical 9.8)
- [CVE-2024-31025](https://insights.sbomify.com/CVE-2024-31025/): SQL Injection vulnerability in ECshop 4.x allows an attacker to obtain sensitive information via the file/article.php component. (high 7.5)
- [CVE-2024-31022](https://insights.sbomify.com/CVE-2024-31022/): Code injection in steve228uk:candycms (critical 9.8)
- [CVE-2024-3102](https://insights.sbomify.com/CVE-2024-3102/): JSON Injection in mintplex-labs/anything-llm (medium 5.3)
- [CVE-2024-31013](https://insights.sbomify.com/CVE-2024-31013/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2024-31012](https://insights.sbomify.com/CVE-2024-31012/): File upload in sem-cms:semcms (critical 9.8)
- [CVE-2024-31011](https://insights.sbomify.com/CVE-2024-31011/): Code injection in beescms:beescms (critical 9.8)
- [CVE-2024-31010](https://insights.sbomify.com/CVE-2024-31010/): SQL injection in sem-cms:semcms (high 7.5)
- [CVE-2024-3101](https://insights.sbomify.com/CVE-2024-3101/): Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm (medium 6.7)
- [CVE-2024-31009](https://insights.sbomify.com/CVE-2024-31009/): SQL injection in sem-cms:semcms (medium 6.5)
- [CVE-2024-31008](https://insights.sbomify.com/CVE-2024-31008/): Auth bypass in wuzhicms:wuzhicms (medium 6.5)
- [CVE-2024-31007](https://insights.sbomify.com/CVE-2024-31007/): Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a crafted file. (medium 5.5)
- [CVE-2024-31005](https://insights.sbomify.com/CVE-2024-31005/): Code injection in axiosys:bento4 (high 8.1)
- [CVE-2024-31004](https://insights.sbomify.com/CVE-2024-31004/): Code injection in axiosys:bento4 (high 8.8)
- [CVE-2024-31003](https://insights.sbomify.com/CVE-2024-31003/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2024-31002](https://insights.sbomify.com/CVE-2024-31002/): Memory corruption in axiosys:bento4 (critical 9.8)
- [CVE-2024-3100](https://insights.sbomify.com/CVE-2024-3100/): Memory corruption in 100w Gen 3 Laptop (Lenovo) BIOS (medium 6.7)
- [CVE-2024-30998](https://insights.sbomify.com/CVE-2024-30998/): SQL injection in phpgurukul:men salon management system (critical 9.8)
- [CVE-2024-30990](https://insights.sbomify.com/CVE-2024-30990/): SQL injection in phpgurukul:client management system (critical 9.8)
- [CVE-2024-3099](https://insights.sbomify.com/CVE-2024-3099/): Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow (medium 5.4)
- [CVE-2024-30989](https://insights.sbomify.com/CVE-2024-30989/): Cross-site scripting in phpgurukul:client management system (medium 5.4)
- [CVE-2024-30988](https://insights.sbomify.com/CVE-2024-30988/): Cross-site scripting in phpgurukul:client management system (medium 6.8)
- [CVE-2024-30987](https://insights.sbomify.com/CVE-2024-30987/): Cross-site scripting in phpgurukul:client management system (medium 6.8)
- [CVE-2024-30986](https://insights.sbomify.com/CVE-2024-30986/): Cross-site scripting in phpgurukul:client management system (medium 6.5)
- [CVE-2024-30985](https://insights.sbomify.com/CVE-2024-30985/): SQL injection in phpgurukul:client management system (critical 9.8)
- [CVE-2024-30983](https://insights.sbomify.com/CVE-2024-30983/): SQL injection in phpgurukul:cyber cafe management system (high 7.3)
- [CVE-2024-30982](https://insights.sbomify.com/CVE-2024-30982/): SQL injection in phpgurukul:cyber cafe management system (critical 9.8)
- [CVE-2024-30981](https://insights.sbomify.com/CVE-2024-30981/): SQL injection in phpgurukul:cyber cafe management system (medium 4.3)
- [CVE-2024-30980](https://insights.sbomify.com/CVE-2024-30980/): SQL injection in phpgurukul:cyber cafe management system (critical 9.8)
- [CVE-2024-3098](https://insights.sbomify.com/CVE-2024-3098/): Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/380/