# Vulnerabilities published in 2024


- [CVE-2024-13244](https://insights.sbomify.com/CVE-2024-13244/): Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008 (high 8.8)
- [CVE-2024-13243](https://insights.sbomify.com/CVE-2024-13243/): Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 (medium 6.5)
- [CVE-2024-13242](https://insights.sbomify.com/CVE-2024-13242/): Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006 (critical 9.1)
- [CVE-2024-13241](https://insights.sbomify.com/CVE-2024-13241/): Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005 (critical 9.1)
- [CVE-2024-13240](https://insights.sbomify.com/CVE-2024-13240/): Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 (high 7.5)
- [CVE-2024-1324](https://insights.sbomify.com/CVE-2024-1324/): QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval (medium 5.3)
- [CVE-2024-13239](https://insights.sbomify.com/CVE-2024-13239/): Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003 (critical 9.8)
- [CVE-2024-13238](https://insights.sbomify.com/CVE-2024-13238/): Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002 (medium 5.4)
- [CVE-2024-13237](https://insights.sbomify.com/CVE-2024-13237/): File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001 (medium 5.4)
- [CVE-2024-13236](https://insights.sbomify.com/CVE-2024-13236/): Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-13235](https://insights.sbomify.com/CVE-2024-13235/): Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-13234](https://insights.sbomify.com/CVE-2024-13234/): Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection (high 7.5)
- [CVE-2024-13232](https://insights.sbomify.com/CVE-2024-13232/): Missing authorization in WordPress Awesome Import & Export Plugin - Import & Export WordPress Data (high 8.8)
- [CVE-2024-13231](https://insights.sbomify.com/CVE-2024-13231/): WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update (medium 5.3)
- [CVE-2024-13230](https://insights.sbomify.com/CVE-2024-13230/): SQL injection in Social Share, Social Login and Social Comments Plugin – Super Socializer (medium 5.3)
- [CVE-2024-1323](https://insights.sbomify.com/CVE-2024-1323/): Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13229](https://insights.sbomify.com/CVE-2024-13229/): Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion (medium 4.3)
- [CVE-2024-13228](https://insights.sbomify.com/CVE-2024-13228/): Information disclosure in Qubely – Advanced Gutenberg Blocks (medium 4.3)
- [CVE-2024-13227](https://insights.sbomify.com/CVE-2024-13227/): Cross-site scripting in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (medium 6.4)
- [CVE-2024-13226](https://insights.sbomify.com/CVE-2024-13226/): A5 Custom Login Page <= 2.8.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13225](https://insights.sbomify.com/CVE-2024-13225/): ECT Home Page Products <= 1.9 - Reflected XSS (medium 6.1)
- [CVE-2024-13224](https://insights.sbomify.com/CVE-2024-13224/): SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS (medium 6.1)
- [CVE-2024-13223](https://insights.sbomify.com/CVE-2024-13223/): Tabulate <= 2.10.3 - Reflected XSS (medium 6.1)
- [CVE-2024-13222](https://insights.sbomify.com/CVE-2024-13222/): User Messages <= 1.2.4 - Reflected XSS (medium 6.1)
- [CVE-2024-13221](https://insights.sbomify.com/CVE-2024-13221/): Fantastic Elasticsearch <= 4.1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-13220](https://insights.sbomify.com/CVE-2024-13220/): Google Map Professional <= 1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-1322](https://insights.sbomify.com/CVE-2024-1322/): Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change (medium 5.3)
- [CVE-2024-13219](https://insights.sbomify.com/CVE-2024-13219/): Policy Genius <= 2.0.4 - Reflected XSS (medium 6.1)
- [CVE-2024-13218](https://insights.sbomify.com/CVE-2024-13218/): Fast Tube <= 2.3.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13217](https://insights.sbomify.com/CVE-2024-13217/): Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas (medium 4.3)
- [CVE-2024-13216](https://insights.sbomify.com/CVE-2024-13216/): Information disclosure in HT Event – WordPress Event Manager Plugin for Elementor (medium 4.3)
- [CVE-2024-13215](https://insights.sbomify.com/CVE-2024-13215/): Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup (medium 4.3)
- [CVE-2024-13213](https://insights.sbomify.com/CVE-2024-13213/): SingMR HouseRent toAdminUpdateHousePage cross site scripting (medium 5.3)
- [CVE-2024-13212](https://insights.sbomify.com/CVE-2024-13212/): SingMR HouseRent AddHouseController.java upload unrestricted upload (medium 5.3)
- [CVE-2024-13211](https://insights.sbomify.com/CVE-2024-13211/): SingMR HouseRent AdminController.java access control (medium 5.3)
- [CVE-2024-13210](https://insights.sbomify.com/CVE-2024-13210/): donglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted upload (medium 5.1)
- [CVE-2024-1321](https://insights.sbomify.com/CVE-2024-1321/): EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass (medium 5.3)
- [CVE-2024-13209](https://insights.sbomify.com/CVE-2024-13209/): Redaxo CMS Structure Management Page index.php cross site scripting (medium 5.1)
- [CVE-2024-13208](https://insights.sbomify.com/CVE-2024-13208/): WP Google Map < 1.9.4 - Admin+ Stored XSS (medium 4.3)
- [CVE-2024-13207](https://insights.sbomify.com/CVE-2024-13207/): Widget for Social Page Feeds < 6.4.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13206](https://insights.sbomify.com/CVE-2024-13206/): REVE Antivirus reveinstall default permission (high 8.5)
- [CVE-2024-13205](https://insights.sbomify.com/CVE-2024-13205/): kurniaramadhan E-Commerce-PHP Create Product Page create_product.php cross site scripting (medium 5.1)
- [CVE-2024-13204](https://insights.sbomify.com/CVE-2024-13204/): kurniaramadhan E-Commerce-PHP blog-details.php sql injection (medium 5.3)
- [CVE-2024-13203](https://insights.sbomify.com/CVE-2024-13203/): kurniaramadhan E-Commerce-PHP cross-site request forgery (medium 6.9)
- [CVE-2024-13202](https://insights.sbomify.com/CVE-2024-13202/): wander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scripting (medium 5.1)
- [CVE-2024-13201](https://insights.sbomify.com/CVE-2024-13201/): wander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted upload (medium 5.1)
- [CVE-2024-13200](https://insights.sbomify.com/CVE-2024-13200/): wander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access control (medium 6.9)
- [CVE-2024-1320](https://insights.sbomify.com/CVE-2024-1320/): EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting (medium 6.5)
- [CVE-2024-13199](https://insights.sbomify.com/CVE-2024-13199/): langhsu Mblog Blog System Search Bar search cross site scripting (medium 5.3)
- [CVE-2024-13198](https://insights.sbomify.com/CVE-2024-13198/): langhsu Mblog Blog System login observable response discrepancy (medium 6.3)
- [CVE-2024-13197](https://insights.sbomify.com/CVE-2024-13197/): donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting (medium 5.3)
- [CVE-2024-13196](https://insights.sbomify.com/CVE-2024-13196/): donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting (medium 5.3)
- [CVE-2024-13195](https://insights.sbomify.com/CVE-2024-13195/): donglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgery (medium 5.3)
- [CVE-2024-13194](https://insights.sbomify.com/CVE-2024-13194/): Sucms admin_members.php sql injection (medium 5.3)
- [CVE-2024-13193](https://insights.sbomify.com/CVE-2024-13193/): SEMCMS Image Library Management Page SEMCMS_Images.php sql injection (medium 5.3)
- [CVE-2024-13192](https://insights.sbomify.com/CVE-2024-13192/): ZeroWdd myblog BlogController.java update cross site scripting (medium 5.3)
- [CVE-2024-13191](https://insights.sbomify.com/CVE-2024-13191/): ZeroWdd myblog uploadController.java upload unrestricted upload (medium 5.3)
- [CVE-2024-13190](https://insights.sbomify.com/CVE-2024-13190/): ZeroWdd myblog BlogMapper.xml xml injection (medium 5.3)
- [CVE-2024-1319](https://insights.sbomify.com/CVE-2024-1319/): Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure (medium 4.3)
- [CVE-2024-13189](https://insights.sbomify.com/CVE-2024-13189/): ZeroWdd myblog MyBlogMvcConfig.java permission (medium 6.9)
- [CVE-2024-13188](https://insights.sbomify.com/CVE-2024-13188/): MicroWorld eScan Antivirus Installation var default permission (medium 4.8)
- [CVE-2024-13187](https://insights.sbomify.com/CVE-2024-13187/): Kingsoft WPS Office TCC code injection (medium 4.8)
- [CVE-2024-13186](https://insights.sbomify.com/CVE-2024-13186/): MinigameCenter information leakage vulnerability (medium 6.3)
- [CVE-2024-13185](https://insights.sbomify.com/CVE-2024-13185/): MinigameCenter module information leakage vulnerability (medium 6.3)
- [CVE-2024-13184](https://insights.sbomify.com/CVE-2024-13184/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module (high 7.5)
- [CVE-2024-13183](https://insights.sbomify.com/CVE-2024-13183/): Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter (medium 6.4)
- [CVE-2024-13182](https://insights.sbomify.com/CVE-2024-13182/): WP Directorybox Manager <= 2.5 - Authentication Bypass (critical 9.8)
- [CVE-2024-13181](https://insights.sbomify.com/CVE-2024-13181/): Auth bypass in Avalanche (high 7.3)
- [CVE-2024-13180](https://insights.sbomify.com/CVE-2024-13180/): Path traversal in Avalanche (high 7.5)
- [CVE-2024-1318](https://insights.sbomify.com/CVE-2024-1318/): RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication (medium 6.5)
- [CVE-2024-13179](https://insights.sbomify.com/CVE-2024-13179/): Auth bypass in Avalanche (high 7.3)
- [CVE-2024-13178](https://insights.sbomify.com/CVE-2024-13178/): Other in Chrome (medium 4.3)
- [CVE-2024-13177](https://insights.sbomify.com/CVE-2024-13177/): Symlink Following in Netskope Client Postinstall Script (medium 5.2)
- [CVE-2024-13176](https://insights.sbomify.com/CVE-2024-13176/): Timing side-channel in ECDSA signature computation (medium 4.1)
- [CVE-2024-13175](https://insights.sbomify.com/CVE-2024-13175/): IDOR in Vidco Software's VOC TESTER (medium 5.5)
- [CVE-2024-13174](https://insights.sbomify.com/CVE-2024-13174/): SQLi in E1 Informatics' Web Application (high 8.6)
- [CVE-2024-13173](https://insights.sbomify.com/CVE-2024-13173/): Health information leakage vulnerability (medium 6.3)
- [CVE-2024-13172](https://insights.sbomify.com/CVE-2024-13172/): Security feature bypass in Endpoint Manager (high 7.8)
- [CVE-2024-13171](https://insights.sbomify.com/CVE-2024-13171/): File upload in Endpoint Manager (high 7.8)
- [CVE-2024-13170](https://insights.sbomify.com/CVE-2024-13170/): Memory corruption in Endpoint Manager (high 7.5)
- [CVE-2024-1317](https://insights.sbomify.com/CVE-2024-1317/): RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection (high 8.8)
- [CVE-2024-13169](https://insights.sbomify.com/CVE-2024-13169/): Memory corruption in Endpoint Manager (high 7.8)
- [CVE-2024-13168](https://insights.sbomify.com/CVE-2024-13168/): Memory corruption in Endpoint Manager (high 7.5)
- [CVE-2024-13167](https://insights.sbomify.com/CVE-2024-13167/): Memory corruption in Endpoint Manager (high 7.5)
- [CVE-2024-13166](https://insights.sbomify.com/CVE-2024-13166/): Memory corruption in Endpoint Manager (high 7.5)
- [CVE-2024-13165](https://insights.sbomify.com/CVE-2024-13165/): Memory corruption in Endpoint Manager (high 7.5)
- [CVE-2024-13164](https://insights.sbomify.com/CVE-2024-13164/): Privilege escalation in Endpoint Manager (high 7.8)
- [CVE-2024-13163](https://insights.sbomify.com/CVE-2024-13163/): Deserialization in Endpoint Manager (high 7.8)
- [CVE-2024-13162](https://insights.sbomify.com/CVE-2024-13162/): SQL injection in Endpoint Manager (high 7.2)
- [CVE-2024-13161](https://insights.sbomify.com/CVE-2024-13161/): Ivanti Endpoint Manager (EPM) Absolute Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2024-13160](https://insights.sbomify.com/CVE-2024-13160/): Ivanti Endpoint Manager (EPM) Absolute Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2024-1316](https://insights.sbomify.com/CVE-2024-1316/): Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access (medium 6.5)
- [CVE-2024-13159](https://insights.sbomify.com/CVE-2024-13159/): Ivanti Endpoint Manager (EPM) Absolute Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2024-13158](https://insights.sbomify.com/CVE-2024-13158/): Code injection in Endpoint Manager (high 7.2)
- [CVE-2024-13157](https://insights.sbomify.com/CVE-2024-13157/): Cross-site scripting in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar (medium 6.4)
- [CVE-2024-13156](https://insights.sbomify.com/CVE-2024-13156/): Cross-site scripting in HTML5 Video Player – Embed and Play Videos in Custom Player (medium 6.4)
- [CVE-2024-13155](https://insights.sbomify.com/CVE-2024-13155/): Cross-site scripting in Unlimited Elements For Elementor (medium 6.4)
- [CVE-2024-13153](https://insights.sbomify.com/CVE-2024-13153/): Cross-site scripting in Unlimited Elements For Elementor (medium 6.4)
- [CVE-2024-13152](https://insights.sbomify.com/CVE-2024-13152/): SQLi in BSS Software's Mobuy Online Machinery Monitoring Panel (critical 10.0)
- [CVE-2024-13151](https://insights.sbomify.com/CVE-2024-13151/): SQLi in ESBI Informatics's Auto Service Software (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/479/