# Vulnerabilities published in 2024


- [CVE-2024-22720](https://insights.sbomify.com/CVE-2024-22720/): Cross-site scripting in kanboard:kanboard (medium 4.8)
- [CVE-2024-2272](https://insights.sbomify.com/CVE-2024-2272/): keerti1924 Online-Book-Store-Website HTTP POST Request home.php sql injection (medium 6.3)
- [CVE-2024-22719](https://insights.sbomify.com/CVE-2024-22719/): SQL injection in formtools:form tools (high 8.1)
- [CVE-2024-22718](https://insights.sbomify.com/CVE-2024-22718/): Cross-site scripting in formtools:form tools (critical 9.6)
- [CVE-2024-22717](https://insights.sbomify.com/CVE-2024-22717/): Cross-site scripting in formtools:form tools (medium 6.1)
- [CVE-2024-22715](https://insights.sbomify.com/CVE-2024-22715/): Cross-site request forgery in codelyfe:stupid simple cms (high 8.8)
- [CVE-2024-22714](https://insights.sbomify.com/CVE-2024-22714/): Cross-site scripting in codelyfe:stupid simple cms (medium 6.1)
- [CVE-2024-2271](https://insights.sbomify.com/CVE-2024-2271/): keerti1924 Online-Book-Store-Website HTTP POST Request shop.php sql injection (medium 6.3)
- [CVE-2024-22705](https://insights.sbomify.com/CVE-2024-22705/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2024-2270](https://insights.sbomify.com/CVE-2024-2270/): keerti1924 Online-Book-Store-Website signup.php cross site scripting (medium 4.3)
- [CVE-2024-22699](https://insights.sbomify.com/CVE-2024-22699/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-2269](https://insights.sbomify.com/CVE-2024-2269/): keerti1924 Online-Book-Store-Website search.php sql injection (medium 6.3)
- [CVE-2024-2268](https://insights.sbomify.com/CVE-2024-2268/): keerti1924 Online-Book-Store-Website unrestricted upload (medium 4.7)
- [CVE-2024-2267](https://insights.sbomify.com/CVE-2024-2267/): keerti1924 Online-Book-Store-Website shop.php logic error (medium 4.3)
- [CVE-2024-22667](https://insights.sbomify.com/CVE-2024-22667/): Memory corruption in fedoraproject:fedora (high 7.8)
- [CVE-2024-22663](https://insights.sbomify.com/CVE-2024-22663/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-22662](https://insights.sbomify.com/CVE-2024-22662/): Memory corruption in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-22660](https://insights.sbomify.com/CVE-2024-22660/): Memory corruption in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-2266](https://insights.sbomify.com/CVE-2024-2266/): keerti1924 Secret-Coder-PHP-Project Login Page login.php cross site scripting (low 3.5)
- [CVE-2024-22654](https://insights.sbomify.com/CVE-2024-22654/): Denial of service in broadcom:tcpreplay (high 7.5)
- [CVE-2024-22653](https://insights.sbomify.com/CVE-2024-22653/): Null dereference in yasm project:yasm (medium 4.8)
- [CVE-2024-22651](https://insights.sbomify.com/CVE-2024-22651/): Command injection in dlink:dir-815 firmware (critical 9.8)
- [CVE-2024-2265](https://insights.sbomify.com/CVE-2024-2265/): keerti1924 PHP-MYSQL-User-Login-System login.sql inclusion of sensitive information in source code (medium 5.3)
- [CVE-2024-22648](https://insights.sbomify.com/CVE-2024-22648/): Server-side request forgery in seopanel:seo panel (medium 5.3)
- [CVE-2024-22647](https://insights.sbomify.com/CVE-2024-22647/): Information disclosure in seopanel:seo panel (medium 5.3)
- [CVE-2024-22646](https://insights.sbomify.com/CVE-2024-22646/): Information disclosure in seopanel:seo panel (medium 5.3)
- [CVE-2024-22643](https://insights.sbomify.com/CVE-2024-22643/): Cross-site request forgery in seopanel:seo panel (medium 6.5)
- [CVE-2024-22641](https://insights.sbomify.com/CVE-2024-22641/): Denial of service in tcpdf project:tcpdf (high 7.5)
- [CVE-2024-22640](https://insights.sbomify.com/CVE-2024-22640/): TCPDF vulnerable to Regular Expression Denial of Service (high 7.5)
- [CVE-2024-2264](https://insights.sbomify.com/CVE-2024-2264/): keerti1924 PHP-MYSQL-User-Login-System login.php sql injection (high 7.3)
- [CVE-2024-22639](https://insights.sbomify.com/CVE-2024-22639/): Cross-site scripting in igalerie:igalerie (medium 6.1)
- [CVE-2024-22638](https://insights.sbomify.com/CVE-2024-22638/): Code injection in livesite:livesite (critical 9.8)
- [CVE-2024-22637](https://insights.sbomify.com/CVE-2024-22637/): Cross-site scripting in formtools:form tools (medium 6.1)
- [CVE-2024-22636](https://insights.sbomify.com/CVE-2024-22636/): Code injection in pluxml:pluxml (high 8.8)
- [CVE-2024-22635](https://insights.sbomify.com/CVE-2024-22635/): Cross-site scripting in webcalendar project:webcalendar (medium 6.1)
- [CVE-2024-22633](https://insights.sbomify.com/CVE-2024-22633/): Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability v (critical 9.8)
- [CVE-2024-22632](https://insights.sbomify.com/CVE-2024-22632/): Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability v (critical 9.8)
- [CVE-2024-2263](https://insights.sbomify.com/CVE-2024-2263/): WooCommerce Product Filter < 1.4.4 - Reflected XSS (medium 4.8)
- [CVE-2024-22628](https://insights.sbomify.com/CVE-2024-22628/): SQL injection in oretnom23:budget and expense tracker system (high 7.2)
- [CVE-2024-22627](https://insights.sbomify.com/CVE-2024-22627/): SQL injection in campcodes:supplier management system (high 7.2)
- [CVE-2024-22626](https://insights.sbomify.com/CVE-2024-22626/): SQL injection in campcodes:supplier management system (high 7.2)
- [CVE-2024-22625](https://insights.sbomify.com/CVE-2024-22625/): SQL injection in campcodes:supplier management system (high 7.2)
- [CVE-2024-2262](https://insights.sbomify.com/CVE-2024-2262/): WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF (medium 4.7)
- [CVE-2024-22611](https://insights.sbomify.com/CVE-2024-22611/): SQL injection in open-emr:openemr (critical 9.8)
- [CVE-2024-2261](https://insights.sbomify.com/CVE-2024-2261/): Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure (medium 4.3)
- [CVE-2024-22603](https://insights.sbomify.com/CVE-2024-22603/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22601](https://insights.sbomify.com/CVE-2024-22601/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-2260](https://insights.sbomify.com/CVE-2024-2260/): Session Fixation Vulnerability in zenml-io/zenml (medium 4.2)
- [CVE-2024-22593](https://insights.sbomify.com/CVE-2024-22593/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22592](https://insights.sbomify.com/CVE-2024-22592/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22591](https://insights.sbomify.com/CVE-2024-22591/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22590](https://insights.sbomify.com/CVE-2024-22590/): The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. (critical 9.1)
- [CVE-2024-2259](https://insights.sbomify.com/CVE-2024-2259/): Reflected XXS Vulnerability in InstaRISPACS Software (medium 6.4)
- [CVE-2024-22588](https://insights.sbomify.com/CVE-2024-22588/): Kwik does not discard unused encryption keys (medium 6.5)
- [CVE-2024-2258](https://insights.sbomify.com/CVE-2024-2258/): Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (medium 4.4)
- [CVE-2024-22570](https://insights.sbomify.com/CVE-2024-22570/): Cross-site scripting in njtech:greencms (medium 5.4)
- [CVE-2024-2257](https://insights.sbomify.com/CVE-2024-2257/): Password Policy Bypass Vulnerability in Digisol Router (critical 9.1)
- [CVE-2024-22569](https://insights.sbomify.com/CVE-2024-22569/): Cross-site scripting in poscms:poscms (medium 5.4)
- [CVE-2024-22568](https://insights.sbomify.com/CVE-2024-22568/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22567](https://insights.sbomify.com/CVE-2024-22567/): mingSoft MCMS File Upload vulnerability (high 8.8)
- [CVE-2024-22563](https://insights.sbomify.com/CVE-2024-22563/): Denial of service in openvswitch:openvswitch (high 7.5)
- [CVE-2024-22562](https://insights.sbomify.com/CVE-2024-22562/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2024-2256](https://insights.sbomify.com/CVE-2024-2256/): oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-22559](https://insights.sbomify.com/CVE-2024-22559/): Cross-site scripting in lightcms project:lightcms (medium 5.4)
- [CVE-2024-22551](https://insights.sbomify.com/CVE-2024-22551/): Cross-site scripting in ushainformatique:whatacart (medium 6.1)
- [CVE-2024-22550](https://insights.sbomify.com/CVE-2024-22550/): File upload in shopsite:shopsite (medium 6.1)
- [CVE-2024-2255](https://insights.sbomify.com/CVE-2024-2255/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 6.4)
- [CVE-2024-22549](https://insights.sbomify.com/CVE-2024-22549/): Cross-site scripting in flycms project:flycms (medium 5.4)
- [CVE-2024-22548](https://insights.sbomify.com/CVE-2024-22548/): Cross-site scripting in flycms project:flycms (medium 5.4)
- [CVE-2024-22547](https://insights.sbomify.com/CVE-2024-22547/): Cross-site scripting in wayos:ibr-7150 firmware (medium 4.7)
- [CVE-2024-22546](https://insights.sbomify.com/CVE-2024-22546/): Command injection in trendnet:tew-815dap firmware (medium 6.4)
- [CVE-2024-22545](https://insights.sbomify.com/CVE-2024-22545/): Command injection in trendnet:tew-824dru firmware (high 7.8)
- [CVE-2024-22544](https://insights.sbomify.com/CVE-2024-22544/): Command injection in linksys:e1700 firmware (high 8.0)
- [CVE-2024-22543](https://insights.sbomify.com/CVE-2024-22543/): Privilege escalation in linksys:e1700 firmware (medium 6.1)
- [CVE-2024-2254](https://insights.sbomify.com/CVE-2024-2254/): RT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting (medium 6.4)
- [CVE-2024-22533](https://insights.sbomify.com/CVE-2024-22533/): Beetl Server-Side Template Injection vulnerability (critical 9.8)
- [CVE-2024-22532](https://insights.sbomify.com/CVE-2024-22532/): Memory corruption in xnview:nconvert (medium 6.5)
- [CVE-2024-2253](https://insights.sbomify.com/CVE-2024-2253/): Testimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-22529](https://insights.sbomify.com/CVE-2024-22529/): Command injection in totolink:x2000r firmware (critical 9.8)
- [CVE-2024-22526](https://insights.sbomify.com/CVE-2024-22526/): Memory corruption in bandisoft:bandiview (medium 5.5)
- [CVE-2024-22525](https://insights.sbomify.com/CVE-2024-22525/): dnspod-sr 0dfbd37 contains a SEGV. (medium 5.5)
- [CVE-2024-22524](https://insights.sbomify.com/CVE-2024-22524/): Memory corruption in dnspod:dnspod security recursive (medium 5.5)
- [CVE-2024-22523](https://insights.sbomify.com/CVE-2024-22523/): Path traversal in fuwushe:ifair (high 7.5)
- [CVE-2024-22520](https://insights.sbomify.com/CVE-2024-22520/): Auth bypass in dronetag:drone scanner (high 8.2)
- [CVE-2024-2252](https://insights.sbomify.com/CVE-2024-2252/): Cross-site scripting in Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder (medium 5.4)
- [CVE-2024-22519](https://insights.sbomify.com/CVE-2024-22519/): Auth bypass in sorenfriis:opendroneid osm (high 8.2)
- [CVE-2024-22515](https://insights.sbomify.com/CVE-2024-22515/): File upload in ispyconnect:agent dvr (high 8.8)
- [CVE-2024-22514](https://insights.sbomify.com/CVE-2024-22514/): Path traversal in ispyconnect:agent dvr (high 8.8)
- [CVE-2024-22513](https://insights.sbomify.com/CVE-2024-22513/): Improper Privilege Management in djangorestframework-simplejwt (medium 5.5)
- [CVE-2024-2250](https://insights.sbomify.com/CVE-2024-2250/): 130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-22497](https://insights.sbomify.com/CVE-2024-22497/): Cross-site Scripting in JFinal (medium 6.1)
- [CVE-2024-22496](https://insights.sbomify.com/CVE-2024-22496/): Cross-site Scripting in JFinal (medium 6.1)
- [CVE-2024-22494](https://insights.sbomify.com/CVE-2024-22494/): Cross-site scripting in jfinalcms project:jfinalcms (medium 5.4)
- [CVE-2024-22493](https://insights.sbomify.com/CVE-2024-22493/): Cross-site Scripting in JFinal (medium 5.4)
- [CVE-2024-22492](https://insights.sbomify.com/CVE-2024-22492/): Cross-site Scripting in JFinal (medium 5.4)
- [CVE-2024-22491](https://insights.sbomify.com/CVE-2024-22491/): Stored Cross Site Scripting in beetl-bbs (medium 5.4)
- [CVE-2024-22490](https://insights.sbomify.com/CVE-2024-22490/): Cross-site Scripting in beetl-bbs (medium 6.1)
- [CVE-2024-2249](https://insights.sbomify.com/CVE-2024-2249/): LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-2248](https://insights.sbomify.com/CVE-2024-2248/): JFrog Artifactory Header Injection (medium 6.4)
- [CVE-2024-22477](https://insights.sbomify.com/CVE-2024-22477/): PingFederate OIDC Policy Management Editor Cross-Site Scripting (low 1.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/442/