# Vulnerabilities published in 2024


- [CVE-2024-25451](https://insights.sbomify.com/CVE-2024-25451/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2024-25450](https://insights.sbomify.com/CVE-2024-25450/): Denial of service in enlightenment:imlib2 (high 8.8)
- [CVE-2024-25448](https://insights.sbomify.com/CVE-2024-25448/): Memory corruption in enlightenment:imlib2 (high 8.8)
- [CVE-2024-25447](https://insights.sbomify.com/CVE-2024-25447/): Memory corruption in enlightenment:imlib2 (high 8.8)
- [CVE-2024-25446](https://insights.sbomify.com/CVE-2024-25446/): Memory corruption in hugin project:hugin (high 7.8)
- [CVE-2024-25445](https://insights.sbomify.com/CVE-2024-25445/): Denial of service in hugin project:hugin (high 7.8)
- [CVE-2024-25443](https://insights.sbomify.com/CVE-2024-25443/): Use after free in hugin project:hugin (high 7.8)
- [CVE-2024-25442](https://insights.sbomify.com/CVE-2024-25442/): Memory corruption in hugin project:hugin (high 7.8)
- [CVE-2024-2544](https://insights.sbomify.com/CVE-2024-2544/): Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions (high 7.4)
- [CVE-2024-25438](https://insights.sbomify.com/CVE-2024-25438/): Cross-site scripting in public knowledge project:open journal systems (medium 6.1)
- [CVE-2024-25436](https://insights.sbomify.com/CVE-2024-25436/): Cross-site scripting in sfu:open journal systems (medium 6.1)
- [CVE-2024-25435](https://insights.sbomify.com/CVE-2024-25435/): Cross-site scripting in md1health:md1patient (medium 6.1)
- [CVE-2024-25434](https://insights.sbomify.com/CVE-2024-25434/): Cross-site scripting in pkp.sfu:open journal systems (medium 5.4)
- [CVE-2024-25431](https://insights.sbomify.com/CVE-2024-25431/): Memory corruption in bytecodealliance:webassembly micro runtime (high 8.8)
- [CVE-2024-2543](https://insights.sbomify.com/CVE-2024-2543/): Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor (medium 4.3)
- [CVE-2024-25428](https://insights.sbomify.com/CVE-2024-25428/): SQL injection in mrcms:mrcms (medium 6.5)
- [CVE-2024-25423](https://insights.sbomify.com/CVE-2024-25423/): Memory corruption in nemetschek:cinema 4d (high 7.0)
- [CVE-2024-25422](https://insights.sbomify.com/CVE-2024-25422/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2024-25421](https://insights.sbomify.com/CVE-2024-25421/): Ignite Realtime Openfire privilege escalation vulnerability (critical 9.8)
- [CVE-2024-25420](https://insights.sbomify.com/CVE-2024-25420/): Ignite Realtime Openfire privilege escalation vulnerability (high 7.2)
- [CVE-2024-2542](https://insights.sbomify.com/CVE-2024-2542/): Jotform Online Forms <= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-25419](https://insights.sbomify.com/CVE-2024-25419/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-25418](https://insights.sbomify.com/CVE-2024-25418/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-25417](https://insights.sbomify.com/CVE-2024-25417/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-25415](https://insights.sbomify.com/CVE-2024-25415/): Code injection in phoenixcart:ce phoenix cart (high 7.2)
- [CVE-2024-25414](https://insights.sbomify.com/CVE-2024-25414/): File upload in cszcms:csz cms (critical 9.8)
- [CVE-2024-25413](https://insights.sbomify.com/CVE-2024-25413/): Code injection in firebearstudio:improved import \& export (critical 9.1)
- [CVE-2024-25412](https://insights.sbomify.com/CVE-2024-25412/): Cross-site scripting in flatpress:flatpress (medium 4.6)
- [CVE-2024-25411](https://insights.sbomify.com/CVE-2024-25411/): Cross-site scripting in flatpress:flatpress (medium 6.1)
- [CVE-2024-25410](https://insights.sbomify.com/CVE-2024-25410/): File upload in flusity:flusity (medium 6.5)
- [CVE-2024-2541](https://insights.sbomify.com/CVE-2024-2541/): Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File (medium 5.3)
- [CVE-2024-25407](https://insights.sbomify.com/CVE-2024-25407/): Weak cryptography in steve-community:steve (high 7.5)
- [CVE-2024-25400](https://insights.sbomify.com/CVE-2024-25400/): SQL injection in intelliants:subrion (critical 9.8)
- [CVE-2024-25399](https://insights.sbomify.com/CVE-2024-25399/): Subrion CMS vulnerable to Cross Site Scripting (medium 6.1)
- [CVE-2024-25398](https://insights.sbomify.com/CVE-2024-25398/): Denial of service in srelay project:srelay (high 7.5)
- [CVE-2024-25395](https://insights.sbomify.com/CVE-2024-25395/): Memory corruption in rt-thread:rt-thread (high 8.8)
- [CVE-2024-25394](https://insights.sbomify.com/CVE-2024-25394/): Memory corruption in rt-thread:rt-thread (medium 4.3)
- [CVE-2024-25393](https://insights.sbomify.com/CVE-2024-25393/): Memory corruption in rt-thread:rt-thread (critical 9.8)
- [CVE-2024-25392](https://insights.sbomify.com/CVE-2024-25392/): Memory corruption in rt-thread:rt-thread (medium 5.9)
- [CVE-2024-25391](https://insights.sbomify.com/CVE-2024-25391/): Memory corruption in rt-thread:rt-thread (high 8.4)
- [CVE-2024-25390](https://insights.sbomify.com/CVE-2024-25390/): Memory corruption in rt-thread:rt-thread (high 8.4)
- [CVE-2024-2539](https://insights.sbomify.com/CVE-2024-2539/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-25389](https://insights.sbomify.com/CVE-2024-25389/): Weak cryptography in rt-thread:rt-thread (high 7.5)
- [CVE-2024-25388](https://insights.sbomify.com/CVE-2024-25388/): Integer overflow in rt-thread:rt-thread (high 8.4)
- [CVE-2024-25386](https://insights.sbomify.com/CVE-2024-25386/): Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbit (high 8.8)
- [CVE-2024-25385](https://insights.sbomify.com/CVE-2024-25385/): Use after free in flvmeta:flvmeta (medium 6.2)
- [CVE-2024-25381](https://insights.sbomify.com/CVE-2024-25381/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2024-2538](https://insights.sbomify.com/CVE-2024-2538/): Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification (medium 5.4)
- [CVE-2024-25376](https://insights.sbomify.com/CVE-2024-25376/): Code injection in thesycon:tusbaudio (high 7.8)
- [CVE-2024-25373](https://insights.sbomify.com/CVE-2024-25373/): Memory corruption in tenda:ac10 firmware (medium 4.6)
- [CVE-2024-25371](https://insights.sbomify.com/CVE-2024-25371/): Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptions. (high 7.5)
- [CVE-2024-2537](https://insights.sbomify.com/CVE-2024-2537/): Electron Code Injection in Logi Tune macOS Application (medium 4.4)
- [CVE-2024-25369](https://insights.sbomify.com/CVE-2024-25369/): Cross-site scripting in thedaylightstudio:fuel cms (medium 6.1)
- [CVE-2024-25366](https://insights.sbomify.com/CVE-2024-25366/): Memory corruption in mz-automation:libiec61850 (medium 6.2)
- [CVE-2024-25360](https://insights.sbomify.com/CVE-2024-25360/): Information disclosure in motorola:cx2l firmware (medium 5.3)
- [CVE-2024-2536](https://insights.sbomify.com/CVE-2024-2536/): Cross-site scripting in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (medium 6.4)
- [CVE-2024-25359](https://insights.sbomify.com/CVE-2024-25359/): Deserialization in zuoxingdong:lagom (medium 6.6)
- [CVE-2024-25355](https://insights.sbomify.com/CVE-2024-25355/): s3-url-parser vulnerable to Denial of Service via regexes component (high 7.5)
- [CVE-2024-25354](https://insights.sbomify.com/CVE-2024-25354/): domain-suffix RegEx Denial of Service (high 7.5)
- [CVE-2024-25351](https://insights.sbomify.com/CVE-2024-25351/): SQL injection in phpgurukul:zoo management system (low 3.8)
- [CVE-2024-25350](https://insights.sbomify.com/CVE-2024-25350/): SQL injection in phpgurukul:zoo management system (critical 9.8)
- [CVE-2024-2535](https://insights.sbomify.com/CVE-2024-2535/): MAGESH-K21 Online-College-Event-Hall-Reservation-System users.php cross site scripting (low 3.5)
- [CVE-2024-25344](https://insights.sbomify.com/CVE-2024-25344/): Cross-site scripting in itflow:itflow (medium 6.1)
- [CVE-2024-25343](https://insights.sbomify.com/CVE-2024-25343/): Security feature bypass in tenda:n300 firmware (critical 9.1)
- [CVE-2024-2534](https://insights.sbomify.com/CVE-2024-2534/): MAGESH-K21 Online-College-Event-Hall-Reservation-System users.php sql injection (medium 6.3)
- [CVE-2024-25331](https://insights.sbomify.com/CVE-2024-25331/): DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. (critical 9.3)
- [CVE-2024-2533](https://insights.sbomify.com/CVE-2024-2533/): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-users.php cross site scripting (low 3.5)
- [CVE-2024-25327](https://insights.sbomify.com/CVE-2024-25327/): Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code vi (medium 6.1)
- [CVE-2024-25325](https://insights.sbomify.com/CVE-2024-25325/): SQL injection in walterjnr1:employee management system (high 7.1)
- [CVE-2024-25320](https://insights.sbomify.com/CVE-2024-25320/): SQL injection in tongda2000:office anywhere (critical 9.8)
- [CVE-2024-2532](https://insights.sbomify.com/CVE-2024-2532/): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-users.php sql injection (medium 6.3)
- [CVE-2024-25318](https://insights.sbomify.com/CVE-2024-25318/): SQL injection in hotel management system project:hotel management system (high 8.8)
- [CVE-2024-25316](https://insights.sbomify.com/CVE-2024-25316/): SQL injection in hotel management system project:hotel management system (critical 9.8)
- [CVE-2024-25315](https://insights.sbomify.com/CVE-2024-25315/): SQL injection in hotel management system project:hotel management system (critical 9.8)
- [CVE-2024-25314](https://insights.sbomify.com/CVE-2024-25314/): SQL injection in hotel management system project:hotel management system (critical 9.8)
- [CVE-2024-25313](https://insights.sbomify.com/CVE-2024-25313/): Auth bypass in code-projects:simple school management system (high 8.8)
- [CVE-2024-25312](https://insights.sbomify.com/CVE-2024-25312/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-25310](https://insights.sbomify.com/CVE-2024-25310/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-2531](https://insights.sbomify.com/CVE-2024-2531/): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php unrestricted upload (medium 6.3)
- [CVE-2024-25309](https://insights.sbomify.com/CVE-2024-25309/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-25308](https://insights.sbomify.com/CVE-2024-25308/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-25307](https://insights.sbomify.com/CVE-2024-25307/): SQL injection in code-projects:cinema seat reservation system (critical 9.8)
- [CVE-2024-25306](https://insights.sbomify.com/CVE-2024-25306/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-25305](https://insights.sbomify.com/CVE-2024-25305/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-25304](https://insights.sbomify.com/CVE-2024-25304/): SQL injection in code-projects:simple school management system (high 8.8)
- [CVE-2024-25302](https://insights.sbomify.com/CVE-2024-25302/): SQL injection in remyandrade:event student attendance system (critical 9.8)
- [CVE-2024-25301](https://insights.sbomify.com/CVE-2024-25301/): Code injection in redaxo:redaxo (high 7.2)
- [CVE-2024-25300](https://insights.sbomify.com/CVE-2024-25300/): Cross-site scripting in redaxo:redaxo (medium 4.6)
- [CVE-2024-2530](https://insights.sbomify.com/CVE-2024-2530/): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php cross site scripting (low 3.5)
- [CVE-2024-25298](https://insights.sbomify.com/CVE-2024-25298/): Code injection in REDAXO (high 7.2)
- [CVE-2024-25297](https://insights.sbomify.com/CVE-2024-25297/): Cross-site scripting in bludit:bludit (medium 4.8)
- [CVE-2024-25294](https://insights.sbomify.com/CVE-2024-25294/): Server-side request forgery in getrebuild:rebuild (critical 9.1)
- [CVE-2024-25293](https://insights.sbomify.com/CVE-2024-25293/): Code injection in mjml:mjml app (critical 9.3)
- [CVE-2024-25292](https://insights.sbomify.com/CVE-2024-25292/): Cross-site scripting in martinbarker:rendertune (critical 9.6)
- [CVE-2024-25291](https://insights.sbomify.com/CVE-2024-25291/): Code injection in deskfiler:deskfiler (critical 9.8)
- [CVE-2024-25290](https://insights.sbomify.com/CVE-2024-25290/): An issue in Casa Systems NL1901ACV R6B032 allows a remote attacker to execute arbitrary code via the userName parameter of the add function. (high 8.0)
- [CVE-2024-2529](https://insights.sbomify.com/CVE-2024-2529/): MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php unrestricted upload (medium 6.3)
- [CVE-2024-25288](https://insights.sbomify.com/CVE-2024-25288/): SQL injection in slims:senayan library management system (medium 4.9)
- [CVE-2024-2528](https://insights.sbomify.com/CVE-2024-2528/): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php sql injection (medium 6.3)
- [CVE-2024-25274](https://insights.sbomify.com/CVE-2024-25274/): File upload in xxyopen:novel-plus (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/423/