# Vulnerabilities published in 2024


- [CVE-2024-3067](https://insights.sbomify.com/CVE-2024-3067/): WooCommerce Google Feed Manager <= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting (high 7.2)
- [CVE-2024-3066](https://insights.sbomify.com/CVE-2024-3066/): Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags (medium 6.4)
- [CVE-2024-30656](https://insights.sbomify.com/CVE-2024-30656/): Denial of service in fireboltt:dream firmware (medium 5.1)
- [CVE-2024-3065](https://insights.sbomify.com/CVE-2024-3065/): Cross-site scripting in PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode (medium 4.4)
- [CVE-2024-30645](https://insights.sbomify.com/CVE-2024-30645/): Command injection in tenda:ac15 firmware (high 8.0)
- [CVE-2024-3064](https://insights.sbomify.com/CVE-2024-3064/): Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-30639](https://insights.sbomify.com/CVE-2024-30639/): Memory corruption in tenda:f1202 firmware (medium 6.5)
- [CVE-2024-30638](https://insights.sbomify.com/CVE-2024-30638/): Memory corruption in tenda:f1202 firmware (medium 4.3)
- [CVE-2024-30637](https://insights.sbomify.com/CVE-2024-30637/): Command injection in tenda:f1202 firmware (high 8.8)
- [CVE-2024-30636](https://insights.sbomify.com/CVE-2024-30636/): Memory corruption in tenda:f1202 firmware (medium 6.5)
- [CVE-2024-30635](https://insights.sbomify.com/CVE-2024-30635/): Memory corruption in tenda:f1202 firmware (critical 9.8)
- [CVE-2024-30634](https://insights.sbomify.com/CVE-2024-30634/): Memory corruption in tenda:f1202 firmware (high 8.0)
- [CVE-2024-30633](https://insights.sbomify.com/CVE-2024-30633/): Memory corruption in tenda:fh1205 firmware (medium 6.5)
- [CVE-2024-30632](https://insights.sbomify.com/CVE-2024-30632/): Memory corruption in tenda:fh1205 firmware (medium 6.5)
- [CVE-2024-30631](https://insights.sbomify.com/CVE-2024-30631/): Memory corruption in tenda:fh1205 firmware (medium 4.3)
- [CVE-2024-30630](https://insights.sbomify.com/CVE-2024-30630/): Memory corruption in tenda:fh1205 firmware (critical 9.8)
- [CVE-2024-3063](https://insights.sbomify.com/CVE-2024-3063/): WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-30629](https://insights.sbomify.com/CVE-2024-30629/): Memory corruption in tenda:fh1205 firmware (medium 5.7)
- [CVE-2024-30628](https://insights.sbomify.com/CVE-2024-30628/): Memory corruption in tenda:fh1205 firmware (critical 9.8)
- [CVE-2024-30627](https://insights.sbomify.com/CVE-2024-30627/): Memory corruption in tenda:fh1205 firmware (high 8.8)
- [CVE-2024-30626](https://insights.sbomify.com/CVE-2024-30626/): Memory corruption in tenda:fh1205 firmware (high 8.0)
- [CVE-2024-30625](https://insights.sbomify.com/CVE-2024-30625/): Memory corruption in tenda:fh1205 firmware (high 8.0)
- [CVE-2024-30624](https://insights.sbomify.com/CVE-2024-30624/): Memory corruption in tenda:fh1205 firmware (high 8.8)
- [CVE-2024-30623](https://insights.sbomify.com/CVE-2024-30623/): Memory corruption in tenda:fh1205 firmware (medium 6.5)
- [CVE-2024-30622](https://insights.sbomify.com/CVE-2024-30622/): Memory corruption in tenda:fh1205 firmware (critical 9.8)
- [CVE-2024-30621](https://insights.sbomify.com/CVE-2024-30621/): Memory corruption in tenda:ax1803 firmware (medium 6.5)
- [CVE-2024-30620](https://insights.sbomify.com/CVE-2024-30620/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2024-3062](https://insights.sbomify.com/CVE-2024-3062/): Save as PDF by Pdfcrowd < 3.2.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-30619](https://insights.sbomify.com/CVE-2024-30619/): Missing authorization in chamilo:chamilo lms (high 7.5)
- [CVE-2024-30618](https://insights.sbomify.com/CVE-2024-30618/): Cross-site scripting in chamilo:chamilo lms (medium 6.1)
- [CVE-2024-30617](https://insights.sbomify.com/CVE-2024-30617/): Cross-site request forgery in chamilo:chamilo lms (medium 5.4)
- [CVE-2024-30616](https://insights.sbomify.com/CVE-2024-30616/): Missing authorization in chamilo:chamilo lms (high 8.8)
- [CVE-2024-30614](https://insights.sbomify.com/CVE-2024-30614/): Information disclosure in ametys:ametys (medium 5.3)
- [CVE-2024-30613](https://insights.sbomify.com/CVE-2024-30613/): Memory corruption in tenda:ac15 firmware (medium 4.3)
- [CVE-2024-30612](https://insights.sbomify.com/CVE-2024-30612/): Memory corruption in tenda:ac10u firmware (high 8.1)
- [CVE-2024-3061](https://insights.sbomify.com/CVE-2024-3061/): HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion (high 7.2)
- [CVE-2024-30607](https://insights.sbomify.com/CVE-2024-30607/): Memory corruption in tenda:fh1203 firmware (high 8.0)
- [CVE-2024-30606](https://insights.sbomify.com/CVE-2024-30606/): Memory corruption in tenda:fh1203 firmware (high 8.0)
- [CVE-2024-30604](https://insights.sbomify.com/CVE-2024-30604/): Memory corruption in tenda:fh1203 firmware (high 7.5)
- [CVE-2024-30603](https://insights.sbomify.com/CVE-2024-30603/): Memory corruption in tenda:fh1203 firmware (medium 6.5)
- [CVE-2024-30602](https://insights.sbomify.com/CVE-2024-30602/): Memory corruption in tenda:fh1203 firmware (critical 9.8)
- [CVE-2024-30601](https://insights.sbomify.com/CVE-2024-30601/): Memory corruption in tenda:fh1203 firmware (high 8.0)
- [CVE-2024-30600](https://insights.sbomify.com/CVE-2024-30600/): Memory corruption in tenda:fh1203 firmware (high 8.0)
- [CVE-2024-3060](https://insights.sbomify.com/CVE-2024-3060/): ENL Newsletter <= 1.0.1 - Admin+ SQL Injection (medium 4.5)
- [CVE-2024-30599](https://insights.sbomify.com/CVE-2024-30599/): Memory corruption in tenda:fh1203 firmware (high 8.8)
- [CVE-2024-30598](https://insights.sbomify.com/CVE-2024-30598/): Memory corruption in tenda:fh1203 firmware (medium 6.5)
- [CVE-2024-30597](https://insights.sbomify.com/CVE-2024-30597/): Memory corruption in tenda:fh1203 firmware (medium 6.5)
- [CVE-2024-30596](https://insights.sbomify.com/CVE-2024-30596/): Memory corruption in tenda:fh1202 firmware (critical 9.8)
- [CVE-2024-30595](https://insights.sbomify.com/CVE-2024-30595/): Memory corruption in tenda:fh1202 firmware (critical 9.8)
- [CVE-2024-30594](https://insights.sbomify.com/CVE-2024-30594/): Memory corruption in tenda:fh1202 firmware (medium 6.5)
- [CVE-2024-30593](https://insights.sbomify.com/CVE-2024-30593/): Memory corruption in tenda:fh1202 firmware (critical 9.8)
- [CVE-2024-30592](https://insights.sbomify.com/CVE-2024-30592/): Memory corruption in tenda:fh1202 firmware (high 8.0)
- [CVE-2024-30591](https://insights.sbomify.com/CVE-2024-30591/): Memory corruption in tenda:fh1202 firmware (high 8.8)
- [CVE-2024-30590](https://insights.sbomify.com/CVE-2024-30590/): Memory corruption in tenda:fh1202 firmware (medium 6.5)
- [CVE-2024-3059](https://insights.sbomify.com/CVE-2024-3059/): ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF (medium 5.7)
- [CVE-2024-30589](https://insights.sbomify.com/CVE-2024-30589/): Memory corruption in tenda:fh1202 firmware (critical 9.8)
- [CVE-2024-30588](https://insights.sbomify.com/CVE-2024-30588/): Memory corruption in tenda:fh1202 firmware (medium 4.3)
- [CVE-2024-30587](https://insights.sbomify.com/CVE-2024-30587/): Memory corruption in tenda:fh1202 firmware (critical 9.8)
- [CVE-2024-30586](https://insights.sbomify.com/CVE-2024-30586/): Memory corruption in tenda:fh1202 firmware (medium 6.5)
- [CVE-2024-30585](https://insights.sbomify.com/CVE-2024-30585/): Memory corruption in tenda:fh1202 firmware (medium 6.5)
- [CVE-2024-30584](https://insights.sbomify.com/CVE-2024-30584/): Memory corruption in tenda:fh1202 firmware (critical 9.8)
- [CVE-2024-30583](https://insights.sbomify.com/CVE-2024-30583/): Memory corruption in tenda:fh1202 firmware (high 8.0)
- [CVE-2024-3058](https://insights.sbomify.com/CVE-2024-3058/): ENL Newsletter <= 1.0.1 - Stored XSS via CSRF (medium 5.4)
- [CVE-2024-30572](https://insights.sbomify.com/CVE-2024-30572/): Command injection in netgear:r6850 firmware (high 8.0)
- [CVE-2024-30571](https://insights.sbomify.com/CVE-2024-30571/): Information disclosure in netgear:r6850 firmware (high 7.5)
- [CVE-2024-30570](https://insights.sbomify.com/CVE-2024-30570/): Information disclosure in netgear:r6850 firmware (medium 5.3)
- [CVE-2024-3057](https://insights.sbomify.com/CVE-2024-3057/): Privilege escalation in FlashArray (critical 9.8)
- [CVE-2024-30569](https://insights.sbomify.com/CVE-2024-30569/): Information disclosure in netgear:r6850 firmware (high 7.5)
- [CVE-2024-30568](https://insights.sbomify.com/CVE-2024-30568/): Command injection in netgear:r6850 firmware (critical 9.8)
- [CVE-2024-30567](https://insights.sbomify.com/CVE-2024-30567/): An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubles (medium 6.3)
- [CVE-2024-30565](https://insights.sbomify.com/CVE-2024-30565/): Code injection in seacms:seacms (high 8.8)
- [CVE-2024-30564](https://insights.sbomify.com/CVE-2024-30564/): @andrei-tatar/nora-firebase-common Prototype Pollution vulnerability (critical 9.8)
- [CVE-2024-30561](https://insights.sbomify.com/CVE-2024-30561/): WordPress Appointment Calendar plugin <= 2.9.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30560](https://insights.sbomify.com/CVE-2024-30560/): WordPress DX-Watermark plugin <= 1.0.4 - CSRF to Arbitrary File Upload and XSS vulnerability (critical 9.6)
- [CVE-2024-3056](https://insights.sbomify.com/CVE-2024-3056/): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack (high 7.7)
- [CVE-2024-30559](https://insights.sbomify.com/CVE-2024-30559/): WordPress Spin 360 deg and 3D Model Viewer plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30558](https://insights.sbomify.com/CVE-2024-30558/): WordPress Add Shortcodes Actions And Filters plugin <= 2.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30557](https://insights.sbomify.com/CVE-2024-30557/): WordPress Aesop Story Engine plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30556](https://insights.sbomify.com/CVE-2024-30556/): WordPress Mighty Classic Pros And Cons plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30555](https://insights.sbomify.com/CVE-2024-30555/): WordPress Ultimate Social Comments plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30554](https://insights.sbomify.com/CVE-2024-30554/): WordPress DD Rating plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30553](https://insights.sbomify.com/CVE-2024-30553/): WordPress WP Twitter Mega Fan Box Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30552](https://insights.sbomify.com/CVE-2024-30552/): WordPress Responsive flipbook plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30551](https://insights.sbomify.com/CVE-2024-30551/): WordPress Sticky Anything plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30550](https://insights.sbomify.com/CVE-2024-30550/): Cross-site scripting in Responsive Image Gallery, Gallery Album (high 7.1)
- [CVE-2024-3055](https://insights.sbomify.com/CVE-2024-3055/): SQL injection in Unlimited Elements For Elementor (high 8.8)
- [CVE-2024-30549](https://insights.sbomify.com/CVE-2024-30549/): WordPress Contact Forms by Cimatti plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30548](https://insights.sbomify.com/CVE-2024-30548/): WordPress underConstruction plugin <= 1.21 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30547](https://insights.sbomify.com/CVE-2024-30547/): WordPress Header Image Slider plugin <= 0.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30546](https://insights.sbomify.com/CVE-2024-30546/): WordPress Login With Ajax plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30545](https://insights.sbomify.com/CVE-2024-30545/): WordPress Social Author Bio plugin <= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2024-30544](https://insights.sbomify.com/CVE-2024-30544/): WordPress Whizzy plugin <= 1.1.18 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30543](https://insights.sbomify.com/CVE-2024-30543/): WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2024-30542](https://insights.sbomify.com/CVE-2024-30542/): WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-30541](https://insights.sbomify.com/CVE-2024-30541/): WordPress LWS Optimize plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30540](https://insights.sbomify.com/CVE-2024-30540/): WordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerability (medium 5.3)
- [CVE-2024-3054](https://insights.sbomify.com/CVE-2024-3054/): WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization (high 7.2)
- [CVE-2024-30539](https://insights.sbomify.com/CVE-2024-30539/): WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30538](https://insights.sbomify.com/CVE-2024-30538/): WordPress DELUCKS SEO plugin <= 2.5.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30537](https://insights.sbomify.com/CVE-2024-30537/): WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/382/