# Vulnerabilities published in 2024


- [CVE-2024-1916](https://insights.sbomify.com/CVE-2024-1916/): Integer overflow in MELSEC-L Series L02CPU (critical 9.8)
- [CVE-2024-1915](https://insights.sbomify.com/CVE-2024-1915/): Memory corruption in MELSEC-L Series L02CPU (critical 9.8)
- [CVE-2024-1914](https://insights.sbomify.com/CVE-2024-1914/): Null dereference in RobotWare 6 (medium 6.5)
- [CVE-2024-1913](https://insights.sbomify.com/CVE-2024-1913/): Memory corruption in RobotWare 6 (high 7.6)
- [CVE-2024-1912](https://insights.sbomify.com/CVE-2024-1912/): Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition (medium 4.3)
- [CVE-2024-1910](https://insights.sbomify.com/CVE-2024-1910/): Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory (medium 4.3)
- [CVE-2024-1909](https://insights.sbomify.com/CVE-2024-1909/): Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory (medium 4.3)
- [CVE-2024-1908](https://insights.sbomify.com/CVE-2024-1908/): Privilege escalation in Enterprise Server (medium 6.3)
- [CVE-2024-1907](https://insights.sbomify.com/CVE-2024-1907/): Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory (medium 4.3)
- [CVE-2024-1906](https://insights.sbomify.com/CVE-2024-1906/): Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory (medium 4.3)
- [CVE-2024-1905](https://insights.sbomify.com/CVE-2024-1905/): Smart Forms < 2.6.96 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-1904](https://insights.sbomify.com/CVE-2024-1904/): MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts (medium 4.3)
- [CVE-2024-1902](https://insights.sbomify.com/CVE-2024-1902/): Session Reuse Vulnerability in lunary-ai/lunary (high 7.5)
- [CVE-2024-1901](https://insights.sbomify.com/CVE-2024-1901/): Denial of service in Server (medium 4.3)
- [CVE-2024-1900](https://insights.sbomify.com/CVE-2024-1900/): Auth bypass in Server (medium 5.5)
- [CVE-2024-1899](https://insights.sbomify.com/CVE-2024-1899/): Showdownjs Denial of Service (medium 5.3)
- [CVE-2024-1898](https://insights.sbomify.com/CVE-2024-1898/): Missing authorization in Server (low 3.9)
- [CVE-2024-1897](https://insights.sbomify.com/CVE-2024-1897/): Grid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode (high 7.5)
- [CVE-2024-1896](https://insights.sbomify.com/CVE-2024-1896/): Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode (high 7.5)
- [CVE-2024-1895](https://insights.sbomify.com/CVE-2024-1895/): Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta (high 7.5)
- [CVE-2024-1894](https://insights.sbomify.com/CVE-2024-1894/): Cross-site scripting in Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) (medium 6.4)
- [CVE-2024-1893](https://insights.sbomify.com/CVE-2024-1893/): Easy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2024-1892](https://insights.sbomify.com/CVE-2024-1892/): ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider (high 7.5)
- [CVE-2024-1891](https://insights.sbomify.com/CVE-2024-1891/): Stored Cross Site Scripting (low 3.5)
- [CVE-2024-1890](https://insights.sbomify.com/CVE-2024-1890/): Clickjacking vulnerability in Sunny Webbox (medium 6.4)
- [CVE-2024-1889](https://insights.sbomify.com/CVE-2024-1889/): Cross-Site Request Forgery vulnerability in SMA Cluster Controller (high 8.8)
- [CVE-2024-1888](https://insights.sbomify.com/CVE-2024-1888/): Existing server guests invited to the team by members without "invite_guest" permission (medium 4.3)
- [CVE-2024-1887](https://insights.sbomify.com/CVE-2024-1887/): Public channel post content accessible without membership when compliance export is enabled (medium 4.3)
- [CVE-2024-1886](https://insights.sbomify.com/CVE-2024-1886/): Absolute path traversal attack on LG Signage (low 3.0)
- [CVE-2024-1885](https://insights.sbomify.com/CVE-2024-1885/): Remote Code Execution attack on LG Signage (medium 6.3)
- [CVE-2024-1884](https://insights.sbomify.com/CVE-2024-1884/): Server Side Request Forgery in PaperCut NG/MF (medium 6.5)
- [CVE-2024-1883](https://insights.sbomify.com/CVE-2024-1883/): Reflected XSS in PaperCut NG/MF (medium 6.3)
- [CVE-2024-1882](https://insights.sbomify.com/CVE-2024-1882/): Server-side resource injection in PaperCut NG/MF (high 7.2)
- [CVE-2024-1881](https://insights.sbomify.com/CVE-2024-1881/): Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt (high 8.8)
- [CVE-2024-1880](https://insights.sbomify.com/CVE-2024-1880/): OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt (high 7.8)
- [CVE-2024-1879](https://insights.sbomify.com/CVE-2024-1879/): CSRF to RCE in significant-gravitas/autogpt (high 8.8)
- [CVE-2024-1878](https://insights.sbomify.com/CVE-2024-1878/): SourceCodester Employee Management System myprofile.php sql injection (medium 6.3)
- [CVE-2024-1877](https://insights.sbomify.com/CVE-2024-1877/): SourceCodester Employee Management System cancel.php sql injection (medium 6.3)
- [CVE-2024-1876](https://insights.sbomify.com/CVE-2024-1876/): SourceCodester Employee Management System psubmit.php sql injection (high 7.3)
- [CVE-2024-1875](https://insights.sbomify.com/CVE-2024-1875/): SourceCodester Complaint Management System Lodge Complaint Section register-complaint.php unrestricted upload (medium 6.3)
- [CVE-2024-1874](https://insights.sbomify.com/CVE-2024-1874/): Command injection via array-ish $command parameter of proc_open() (critical 9.4)
- [CVE-2024-1873](https://insights.sbomify.com/CVE-2024-1873/): Path Traversal and Denial of Service in parisneo/lollms-webui (high 8.2)
- [CVE-2024-1872](https://insights.sbomify.com/CVE-2024-1872/): Button <= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode (high 8.8)
- [CVE-2024-1871](https://insights.sbomify.com/CVE-2024-1871/): SourceCodester Employee Management System Project Assignment Report assignp.php cross site scripting (low 3.5)
- [CVE-2024-1870](https://insights.sbomify.com/CVE-2024-1870/): Colibri Page Builder <= 1.0.260 - Missing Authorization (medium 4.3)
- [CVE-2024-1869](https://insights.sbomify.com/CVE-2024-1869/): Memory corruption in HP DesignJet (high 7.5)
- [CVE-2024-1868](https://insights.sbomify.com/CVE-2024-1868/): G DATA Total Security Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-1867](https://insights.sbomify.com/CVE-2024-1867/): G DATA Total Security Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-1863](https://insights.sbomify.com/CVE-2024-1863/): Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-1862](https://insights.sbomify.com/CVE-2024-1862/): Missing authorization in Add to Cart Custom Redirect for WooCommerce (high 8.1)
- [CVE-2024-1861](https://insights.sbomify.com/CVE-2024-1861/): Missing authorization in Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan (medium 4.3)
- [CVE-2024-1860](https://insights.sbomify.com/CVE-2024-1860/): Missing authorization in Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan (medium 6.5)
- [CVE-2024-1859](https://insights.sbomify.com/CVE-2024-1859/): Deserialization in Responsive Slideshow (high 8.8)
- [CVE-2024-1858](https://insights.sbomify.com/CVE-2024-1858/): Lightbox slider – Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection (medium 5.4)
- [CVE-2024-1857](https://insights.sbomify.com/CVE-2024-1857/): Missing authorization in Ultimate Gift Cards for WooCommerce (medium 5.3)
- [CVE-2024-1856](https://insights.sbomify.com/CVE-2024-1856/): Progress Telerik Reporting Remote Deserialization Vulnerability (high 8.5)
- [CVE-2024-1855](https://insights.sbomify.com/CVE-2024-1855/): WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery (medium 5.3)
- [CVE-2024-1854](https://insights.sbomify.com/CVE-2024-1854/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 6.4)
- [CVE-2024-1853](https://insights.sbomify.com/CVE-2024-1853/): Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination (medium 5.5)
- [CVE-2024-1852](https://insights.sbomify.com/CVE-2024-1852/): WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-1851](https://insights.sbomify.com/CVE-2024-1851/): affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list (medium 6.3)
- [CVE-2024-1850](https://insights.sbomify.com/CVE-2024-1850/): AI Post Generator | AutoWriter <= 3.3 - Missing Authorization (medium 6.3)
- [CVE-2024-1849](https://insights.sbomify.com/CVE-2024-1849/): WP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection (medium 5.4)
- [CVE-2024-1848](https://insights.sbomify.com/CVE-2024-1848/): Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024 (high 7.8)
- [CVE-2024-1847](https://insights.sbomify.com/CVE-2024-1847/): Memory corruption in eDrawings (high 7.8)
- [CVE-2024-1846](https://insights.sbomify.com/CVE-2024-1846/): Responsive Tabs < 4.0.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-1845](https://insights.sbomify.com/CVE-2024-1845/): VikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery (high 8.0)
- [CVE-2024-1844](https://insights.sbomify.com/CVE-2024-1844/): RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization (medium 4.3)
- [CVE-2024-1843](https://insights.sbomify.com/CVE-2024-1843/): Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink (medium 4.3)
- [CVE-2024-1842](https://insights.sbomify.com/CVE-2024-1842/): Cross-site scripting in WPBakery Page Builder (medium 6.4)
- [CVE-2024-1841](https://insights.sbomify.com/CVE-2024-1841/): WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute (medium 6.4)
- [CVE-2024-1840](https://insights.sbomify.com/CVE-2024-1840/): WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author (medium 6.4)
- [CVE-2024-1839](https://insights.sbomify.com/CVE-2024-1839/): SQL injection in 911 Emergency Gateway (EGW) (critical 10.0)
- [CVE-2024-1834](https://insights.sbomify.com/CVE-2024-1834/): SourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scripting (low 3.5)
- [CVE-2024-1833](https://insights.sbomify.com/CVE-2024-1833/): SourceCodester Employee Management System login.php sql injection (medium 6.9)
- [CVE-2024-1832](https://insights.sbomify.com/CVE-2024-1832/): SourceCodester Complete File Management System Admin Login Form sql injection (high 7.3)
- [CVE-2024-1831](https://insights.sbomify.com/CVE-2024-1831/): SourceCodester Complete File Management System Login Form index.php sql injection (high 7.3)
- [CVE-2024-1830](https://insights.sbomify.com/CVE-2024-1830/): code-projects Library System lost-password.php sql injection (high 7.3)
- [CVE-2024-1829](https://insights.sbomify.com/CVE-2024-1829/): code-projects Library System registration.php sql injection (high 7.3)
- [CVE-2024-1828](https://insights.sbomify.com/CVE-2024-1828/): code-projects Library System registration.php sql injection (high 7.3)
- [CVE-2024-1827](https://insights.sbomify.com/CVE-2024-1827/): code-projects Library System login.php sql injection (high 7.3)
- [CVE-2024-1826](https://insights.sbomify.com/CVE-2024-1826/): code-projects Library System login.php sql injection (high 7.3)
- [CVE-2024-1825](https://insights.sbomify.com/CVE-2024-1825/): CodeAstro House Rental Management System User Registration Page cross site scripting (medium 4.3)
- [CVE-2024-1824](https://insights.sbomify.com/CVE-2024-1824/): CodeAstro House Rental Management System signing.php sql injection (high 7.3)
- [CVE-2024-1823](https://insights.sbomify.com/CVE-2024-1823/): CodeAstro Simple Voting System Backend users.php access control (medium 5.3)
- [CVE-2024-1822](https://insights.sbomify.com/CVE-2024-1822/): PHPGurukul Tourism Management System user-bookings.php cross site scripting (low 2.4)
- [CVE-2024-1821](https://insights.sbomify.com/CVE-2024-1821/): code-projects Crime Reporting System police_add.php sql injection (medium 5.5)
- [CVE-2024-1820](https://insights.sbomify.com/CVE-2024-1820/): code-projects Crime Reporting System inchargelogin.php sql injection (high 7.3)
- [CVE-2024-1819](https://insights.sbomify.com/CVE-2024-1819/): CodeAstro Membership Management System Add Members Tab unrestricted upload (medium 4.7)
- [CVE-2024-1818](https://insights.sbomify.com/CVE-2024-1818/): CodeAstro Membership Management System Logo unrestricted upload (medium 4.7)
- [CVE-2024-1817](https://insights.sbomify.com/CVE-2024-1817/): Demososo DM Enterprise Website Building System Cookie indexDM_load.php dmlogin improper authentication (high 7.3)
- [CVE-2024-1816](https://insights.sbomify.com/CVE-2024-1816/): Uncontrolled Resource Consumption in GitLab (medium 5.3)
- [CVE-2024-1815](https://insights.sbomify.com/CVE-2024-1815/): Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor (medium 6.4)
- [CVE-2024-1814](https://insights.sbomify.com/CVE-2024-1814/): Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor (medium 6.4)
- [CVE-2024-1813](https://insights.sbomify.com/CVE-2024-1813/): Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields (critical 9.8)
- [CVE-2024-1812](https://insights.sbomify.com/CVE-2024-1812/): Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url (high 7.2)
- [CVE-2024-1811](https://insights.sbomify.com/CVE-2024-1811/): OpenText ArcSight Platform Remote Vulnerability (critical 9.8)
- [CVE-2024-1810](https://insights.sbomify.com/CVE-2024-1810/): Archivist – Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1809](https://insights.sbomify.com/CVE-2024-1809/): Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization (medium 5.4)
- [CVE-2024-1808](https://insights.sbomify.com/CVE-2024-1808/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/466/