# Vulnerabilities published in 2024


- [CVE-2024-2591](https://insights.sbomify.com/CVE-2024-2591/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25909](https://insights.sbomify.com/CVE-2024-25909/): WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2024-25908](https://insights.sbomify.com/CVE-2024-25908/): WordPress WP Media folder plugin <= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability (medium 4.3)
- [CVE-2024-25907](https://insights.sbomify.com/CVE-2024-25907/): WordPress WP Media folder plugin <= 5.7.2 - Plugin Settings Change vulnerability (medium 5.4)
- [CVE-2024-25906](https://insights.sbomify.com/CVE-2024-25906/): WordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerability (medium 4.3)
- [CVE-2024-25905](https://insights.sbomify.com/CVE-2024-25905/): WordPress Multi Step Form Plugin <= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-25904](https://insights.sbomify.com/CVE-2024-25904/): WordPress TinyMCE Professional Formats and Styles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-25903](https://insights.sbomify.com/CVE-2024-25903/): WordPress Frontend File Manager Plugin plugin <= 22.7 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-25902](https://insights.sbomify.com/CVE-2024-25902/): WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2024-2590](https://insights.sbomify.com/CVE-2024-2590/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25898](https://insights.sbomify.com/CVE-2024-25898/): Cross-site scripting in churchcrm:churchcrm (medium 6.1)
- [CVE-2024-25897](https://insights.sbomify.com/CVE-2024-25897/): SQL injection in churchcrm:churchcrm (critical 9.8)
- [CVE-2024-25896](https://insights.sbomify.com/CVE-2024-25896/): SQL injection in churchcrm:churchcrm (medium 5.3)
- [CVE-2024-25895](https://insights.sbomify.com/CVE-2024-25895/): Cross-site scripting in churchcrm:churchcrm (medium 6.1)
- [CVE-2024-25894](https://insights.sbomify.com/CVE-2024-25894/): SQL injection in churchcrm:churchcrm (critical 9.8)
- [CVE-2024-25893](https://insights.sbomify.com/CVE-2024-25893/): SQL injection in churchcrm:churchcrm (critical 9.1)
- [CVE-2024-25892](https://insights.sbomify.com/CVE-2024-25892/): SQL injection in churchcrm:churchcrm (high 8.1)
- [CVE-2024-25891](https://insights.sbomify.com/CVE-2024-25891/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2024-2589](https://insights.sbomify.com/CVE-2024-2589/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25885](https://insights.sbomify.com/CVE-2024-25885/): xhtml2pdf Denial of Service via crafted string (high 7.5)
- [CVE-2024-25883](https://insights.sbomify.com/CVE-2024-25883/): The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors. (medium 5.3)
- [CVE-2024-2588](https://insights.sbomify.com/CVE-2024-2588/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25876](https://insights.sbomify.com/CVE-2024-25876/): Enhavo Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-25875](https://insights.sbomify.com/CVE-2024-25875/): Enhavo Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-25874](https://insights.sbomify.com/CVE-2024-25874/): Enhavo Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2024-25873](https://insights.sbomify.com/CVE-2024-25873/): Cross-site scripting in enhavo:enhavo (medium 5.4)
- [CVE-2024-2587](https://insights.sbomify.com/CVE-2024-2587/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25869](https://insights.sbomify.com/CVE-2024-25869/): File upload in codeastro:membership management system (high 8.8)
- [CVE-2024-25868](https://insights.sbomify.com/CVE-2024-25868/): Cross-site scripting in codeastro:membership management system (medium 6.1)
- [CVE-2024-25867](https://insights.sbomify.com/CVE-2024-25867/): SQL injection in codeastro:membership management system (critical 9.1)
- [CVE-2024-25866](https://insights.sbomify.com/CVE-2024-25866/): SQL injection in codeastro:membership management system (high 8.8)
- [CVE-2024-25865](https://insights.sbomify.com/CVE-2024-25865/): hexo-theme-anzhiyu Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-25864](https://insights.sbomify.com/CVE-2024-25864/): Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code a (critical 9.1)
- [CVE-2024-2586](https://insights.sbomify.com/CVE-2024-2586/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25859](https://insights.sbomify.com/CVE-2024-25859/): Path traversal in phillipsdata:blesta (high 7.1)
- [CVE-2024-25858](https://insights.sbomify.com/CVE-2024-25858/): Code injection in foxit:pdf editor (high 8.4)
- [CVE-2024-25854](https://insights.sbomify.com/CVE-2024-25854/): Cross-site scripting in munyweki:insurance management system (medium 6.1)
- [CVE-2024-25852](https://insights.sbomify.com/CVE-2024-25852/): Command injection in linksys:re7000 firmware (high 8.8)
- [CVE-2024-25851](https://insights.sbomify.com/CVE-2024-25851/): Command injection in netis-systems:wf2780 firmware (high 8.0)
- [CVE-2024-25850](https://insights.sbomify.com/CVE-2024-25850/): Command injection in netis-systems:wf2780 firmware (critical 9.8)
- [CVE-2024-2585](https://insights.sbomify.com/CVE-2024-2585/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25849](https://insights.sbomify.com/CVE-2024-25849/): SQL injection in prestatoolkit:make an offer\/offer your price (critical 9.8)
- [CVE-2024-25848](https://insights.sbomify.com/CVE-2024-25848/): SQL injection in team-ever:seo (medium 5.9)
- [CVE-2024-25847](https://insights.sbomify.com/CVE-2024-25847/): SQL injection in myprestamodules:product catalog \(csv\, excel\) import (critical 9.8)
- [CVE-2024-25846](https://insights.sbomify.com/CVE-2024-25846/): File upload in myprestamodules:product catalog \(csv\, excel\) import (critical 9.1)
- [CVE-2024-25845](https://insights.sbomify.com/CVE-2024-25845/): SQL injection in cleanpresta:cd custom fields 4 orders (critical 9.8)
- [CVE-2024-25844](https://insights.sbomify.com/CVE-2024-25844/): Information disclosure in common-services:so flexibilite (high 7.5)
- [CVE-2024-25843](https://insights.sbomify.com/CVE-2024-25843/): SQL injection in prestashop:import\/update bulk product (critical 9.8)
- [CVE-2024-25842](https://insights.sbomify.com/CVE-2024-25842/): Privilege escalation in prestaworld:account manager (high 7.5)
- [CVE-2024-25841](https://insights.sbomify.com/CVE-2024-25841/): Cross-site scripting in common-services:so flexibilite (medium 5.9)
- [CVE-2024-25840](https://insights.sbomify.com/CVE-2024-25840/): Path traversal in prestaworld:account manager (high 7.5)
- [CVE-2024-2584](https://insights.sbomify.com/CVE-2024-2584/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25839](https://insights.sbomify.com/CVE-2024-25839/): Information disclosure in webbax:super newsletter (high 7.5)
- [CVE-2024-25837](https://insights.sbomify.com/CVE-2024-25837/): Cross-site scripting in octobercms:october (medium 5.4)
- [CVE-2024-25833](https://insights.sbomify.com/CVE-2024-25833/): SQL injection in f-logic:datacube3 (critical 9.8)
- [CVE-2024-25832](https://insights.sbomify.com/CVE-2024-25832/): File upload in f-logic:datacube3 (high 8.8)
- [CVE-2024-25831](https://insights.sbomify.com/CVE-2024-25831/): Cross-site scripting in f-logic:datacube3 (medium 6.1)
- [CVE-2024-25830](https://insights.sbomify.com/CVE-2024-25830/): Path traversal in f-logic:datacube3 firmware (critical 9.8)
- [CVE-2024-2583](https://insights.sbomify.com/CVE-2024-2583/): Shortcodes Ultimate < 7.0.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-25828](https://insights.sbomify.com/CVE-2024-25828/): Path traversal in cmseasy:cmseasy (medium 4.9)
- [CVE-2024-25825](https://insights.sbomify.com/CVE-2024-25825/): FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the (critical 9.8)
- [CVE-2024-25817](https://insights.sbomify.com/CVE-2024-25817/): eza Potential Heap Overflow Vulnerability for AArch64 (high 8.4)
- [CVE-2024-25814](https://insights.sbomify.com/CVE-2024-25814/): Cross-site scripting in airc:mynet (medium 6.1)
- [CVE-2024-25812](https://insights.sbomify.com/CVE-2024-25812/): Cross-site scripting in airc:mynet (medium 6.1)
- [CVE-2024-25811](https://insights.sbomify.com/CVE-2024-25811/): Missing authorization in iteachyou:dreamer cms (medium 6.5)
- [CVE-2024-2581](https://insights.sbomify.com/CVE-2024-2581/): Tenda AC10 SetStaticRouteCfg fromSetRouteStatic stack-based overflow (high 8.8)
- [CVE-2024-25808](https://insights.sbomify.com/CVE-2024-25808/): Cross-site request forgery in lycheeorg:lychee (high 8.3)
- [CVE-2024-25807](https://insights.sbomify.com/CVE-2024-25807/): Cross-site scripting in lycheeorg:lychee (medium 6.1)
- [CVE-2024-25802](https://insights.sbomify.com/CVE-2024-25802/): File upload in skinsoft:s-museum (critical 9.8)
- [CVE-2024-25801](https://insights.sbomify.com/CVE-2024-25801/): Cross-site scripting in skinsoft:s-museum (medium 4.6)
- [CVE-2024-2580](https://insights.sbomify.com/CVE-2024-2580/): Cross-site scripting in Automation By Autonami (medium 6.5)
- [CVE-2024-2579](https://insights.sbomify.com/CVE-2024-2579/): WordPress Tracking Code Manager plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-2578](https://insights.sbomify.com/CVE-2024-2578/): WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-25770](https://insights.sbomify.com/CVE-2024-25770/): Denial of service in libming:libming (medium 4.3)
- [CVE-2024-2577](https://insights.sbomify.com/CVE-2024-2577/): SourceCodester Employee Task Management System update-employee.php authorization (high 7.3)
- [CVE-2024-25768](https://insights.sbomify.com/CVE-2024-25768/): Null dereference in trusteddomain:opendmarc (high 7.5)
- [CVE-2024-25767](https://insights.sbomify.com/CVE-2024-25767/): Use after free in emqx:nanomq (medium 6.5)
- [CVE-2024-25763](https://insights.sbomify.com/CVE-2024-25763/): Use after free in opennds:opennds (medium 5.5)
- [CVE-2024-2576](https://insights.sbomify.com/CVE-2024-2576/): SourceCodester Employee Task Management System update-admin.php authorization (high 7.3)
- [CVE-2024-25756](https://insights.sbomify.com/CVE-2024-25756/): Memory corruption in tenda:ac9 firmware (high 8.0)
- [CVE-2024-25753](https://insights.sbomify.com/CVE-2024-25753/): Memory corruption in tenda:ac9 firmware (high 8.8)
- [CVE-2024-25751](https://insights.sbomify.com/CVE-2024-25751/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2024-2575](https://insights.sbomify.com/CVE-2024-2575/): SourceCodester Employee Task Management System task-details.php authorization (high 7.3)
- [CVE-2024-25748](https://insights.sbomify.com/CVE-2024-25748/): Memory corruption in tenda:ac9 firmware (high 8.8)
- [CVE-2024-25746](https://insights.sbomify.com/CVE-2024-25746/): Memory corruption in tenda:ac9 firmware (high 8.8)
- [CVE-2024-25744](https://insights.sbomify.com/CVE-2024-25744/): Security feature bypass in linux:linux kernel (high 8.8)
- [CVE-2024-25743](https://insights.sbomify.com/CVE-2024-25743/): In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIG (high 7.1)
- [CVE-2024-25742](https://insights.sbomify.com/CVE-2024-25742/): In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. (medium 6.5)
- [CVE-2024-25741](https://insights.sbomify.com/CVE-2024-25741/): Other in linux:linux kernel (medium 5.5)
- [CVE-2024-25740](https://insights.sbomify.com/CVE-2024-25740/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2024-2574](https://insights.sbomify.com/CVE-2024-2574/): SourceCodester Employee Task Management System edit-task.php authorization (high 7.3)
- [CVE-2024-25739](https://insights.sbomify.com/CVE-2024-25739/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2024-25738](https://insights.sbomify.com/CVE-2024-25738/): VuFind Server-Side Request Forgery (SSRF) vulnerability (critical 9.1)
- [CVE-2024-25737](https://insights.sbomify.com/CVE-2024-25737/): VuFind Server-Side Request Forgery (SSRF) vulnerability (medium 6.1)
- [CVE-2024-25736](https://insights.sbomify.com/CVE-2024-25736/): Missing authorization in wyrestorm:apollo vx20 firmware (high 7.5)
- [CVE-2024-25735](https://insights.sbomify.com/CVE-2024-25735/): Information disclosure in wyrestorm:apollo vx20 firmware (critical 9.1)
- [CVE-2024-25734](https://insights.sbomify.com/CVE-2024-25734/): Information disclosure in wyrestorm:apollo vx20 firmware (high 7.5)
- [CVE-2024-25731](https://insights.sbomify.com/CVE-2024-25731/): Hardcoded credentials in elinksmart:esmartcam (high 7.5)
- [CVE-2024-25730](https://insights.sbomify.com/CVE-2024-25730/): Weak cryptography in hitrontech:coda-4582u firmware (critical 9.8)
- [CVE-2024-2573](https://insights.sbomify.com/CVE-2024-2573/): SourceCodester Employee Task Management System task-info.php redirect (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/420/