# Vulnerabilities published in 2024


- [CVE-2024-13150](https://insights.sbomify.com/CVE-2024-13150/): SQLi in Fayton Software's fayton.pro ERP (critical 9.8)
- [CVE-2024-1315](https://insights.sbomify.com/CVE-2024-1315/): Classified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account (high 8.8)
- [CVE-2024-13149](https://insights.sbomify.com/CVE-2024-13149/): SQLi in Arma Store's Armalife (critical 9.8)
- [CVE-2024-13148](https://insights.sbomify.com/CVE-2024-13148/): SQLi in Yukseloglu Filter's B2B Login Platform (critical 9.8)
- [CVE-2024-13147](https://insights.sbomify.com/CVE-2024-13147/): SQLi in Merkur Software's B2B Login Panel (critical 9.8)
- [CVE-2024-13146](https://insights.sbomify.com/CVE-2024-13146/): Booknetic < 4.1.5 - Staff Creation via CSRF (high 8.8)
- [CVE-2024-13145](https://insights.sbomify.com/CVE-2024-13145/): zhenfeng13 My-Blog uploadController. java upload unrestricted upload (medium 5.3)
- [CVE-2024-13144](https://insights.sbomify.com/CVE-2024-13144/): zhenfeng13 My-Blog BlogController.java uploadFileByEditomd unrestricted upload (medium 5.3)
- [CVE-2024-13143](https://insights.sbomify.com/CVE-2024-13143/): ZeroWdd studentmanager PermissionController. java submitAddPermission cross site scripting (medium 5.1)
- [CVE-2024-13142](https://insights.sbomify.com/CVE-2024-13142/): ZeroWdd studentmanager RoleController. java submitAddRole cross site scripting (medium 5.1)
- [CVE-2024-13141](https://insights.sbomify.com/CVE-2024-13141/): osuuu LightPicture SVG File Upload upload cross site scripting (medium 5.3)
- [CVE-2024-13140](https://insights.sbomify.com/CVE-2024-13140/): Emlog Pro Cover Upload article.php cross site scripting (medium 5.3)
- [CVE-2024-13139](https://insights.sbomify.com/CVE-2024-13139/): wangl1989 mysiteforme FileController doContent server-side request forgery (medium 5.3)
- [CVE-2024-13138](https://insights.sbomify.com/CVE-2024-13138/): wangl1989 mysiteforme LocalUploadServiceImpl upload unrestricted upload (medium 5.1)
- [CVE-2024-13137](https://insights.sbomify.com/CVE-2024-13137/): wangl1989 mysiteforme SiteController RestResponse cross site scripting (medium 5.1)
- [CVE-2024-13136](https://insights.sbomify.com/CVE-2024-13136/): wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization (medium 5.3)
- [CVE-2024-13135](https://insights.sbomify.com/CVE-2024-13135/): Emlog Pro Subpage twitter.php cross site scripting (medium 5.3)
- [CVE-2024-13134](https://insights.sbomify.com/CVE-2024-13134/): ZeroWdd studentmanager TeacherController. java editTeacher unrestricted upload (medium 5.3)
- [CVE-2024-13133](https://insights.sbomify.com/CVE-2024-13133/): ZeroWdd studentmanager StudentController. java editStudent unrestricted upload (medium 5.3)
- [CVE-2024-13132](https://insights.sbomify.com/CVE-2024-13132/): Emlog Pro Subpage article.php cross site scripting (medium 5.3)
- [CVE-2024-13130](https://insights.sbomify.com/CVE-2024-13130/): Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal (medium 5.3)
- [CVE-2024-1313](https://insights.sbomify.com/CVE-2024-1313/): Users outside an organization can delete a snapshot with its key (medium 6.5)
- [CVE-2024-13129](https://insights.sbomify.com/CVE-2024-13129/): Roxy-WI roxy.py action_service os command injection (high 8.7)
- [CVE-2024-13128](https://insights.sbomify.com/CVE-2024-13128/): LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13127](https://insights.sbomify.com/CVE-2024-13127/): LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13126](https://insights.sbomify.com/CVE-2024-13126/): Download Manager < 3.3.07 - Unauthenticated Data Exposure (medium 4.6)
- [CVE-2024-13125](https://insights.sbomify.com/CVE-2024-13125/): Everest Forms < 3.0.8.1 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13124](https://insights.sbomify.com/CVE-2024-13124/): Photo Gallery by 10Web < 1.8.33 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13123](https://insights.sbomify.com/CVE-2024-13123/): AFI < 1.100.0 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13122](https://insights.sbomify.com/CVE-2024-13122/): AFI < 1.100.0 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13121](https://insights.sbomify.com/CVE-2024-13121/): Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13120](https://insights.sbomify.com/CVE-2024-13120/): ProfilePress < 4.15.20 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1312](https://insights.sbomify.com/CVE-2024-1312/): Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcu (medium 5.1)
- [CVE-2024-13119](https://insights.sbomify.com/CVE-2024-13119/): ProfilePress < 4.15.20 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13118](https://insights.sbomify.com/CVE-2024-13118/): IP Based Login < 2.4.1 - Log Deletion via CSRF (medium 4.3)
- [CVE-2024-13117](https://insights.sbomify.com/CVE-2024-13117/): Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal (medium 6.5)
- [CVE-2024-13116](https://insights.sbomify.com/CVE-2024-13116/): Crelly Slider < 1.4.7 - Admin+ Stored XSS (low 3.8)
- [CVE-2024-13115](https://insights.sbomify.com/CVE-2024-13115/): WP Projects Portfolio with Client Testimonials <= 3.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-13114](https://insights.sbomify.com/CVE-2024-13114/): WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS (medium 6.1)
- [CVE-2024-13113](https://insights.sbomify.com/CVE-2024-13113/): Countdown Timer for Elementor < 1.3.7 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-13112](https://insights.sbomify.com/CVE-2024-13112/): WP MediaTagger <= 4.1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13111](https://insights.sbomify.com/CVE-2024-13111/): Beijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authentication (medium 6.3)
- [CVE-2024-13110](https://insights.sbomify.com/CVE-2024-13110/): Information disclosure in Yunfan Learning Examination System (medium 5.3)
- [CVE-2024-1311](https://insights.sbomify.com/CVE-2024-1311/): Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-13109](https://insights.sbomify.com/CVE-2024-13109/): Beijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization (medium 6.9)
- [CVE-2024-13108](https://insights.sbomify.com/CVE-2024-13108/): D-Link DIR-816 A2 form2NetSniper.cgi access control (medium 6.9)
- [CVE-2024-13107](https://insights.sbomify.com/CVE-2024-13107/): D-Link DIR-816 A2 ACL form2LocalAclEditcfg.cgi access control (medium 6.9)
- [CVE-2024-13106](https://insights.sbomify.com/CVE-2024-13106/): D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control (medium 6.9)
- [CVE-2024-13105](https://insights.sbomify.com/CVE-2024-13105/): D-Link DIR-816 A2 DHCPD Setting form2Dhcpd.cgi access control (medium 6.9)
- [CVE-2024-13104](https://insights.sbomify.com/CVE-2024-13104/): D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control (medium 6.9)
- [CVE-2024-13103](https://insights.sbomify.com/CVE-2024-13103/): D-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access control (medium 6.9)
- [CVE-2024-13102](https://insights.sbomify.com/CVE-2024-13102/): D-Link DIR-816 A2 DDNS Service access control (medium 6.9)
- [CVE-2024-13101](https://insights.sbomify.com/CVE-2024-13101/): WP MediaTagger <= 4.1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-13100](https://insights.sbomify.com/CVE-2024-13100/): Woo UPS Pickup <= 2.6.3 - Reflected XSS (medium 6.1)
- [CVE-2024-1310](https://insights.sbomify.com/CVE-2024-1310/): WooCommerce < 8.6 - Contributor+ Private/Draft Products Access (medium 4.9)
- [CVE-2024-13099](https://insights.sbomify.com/CVE-2024-13099/): Widget4call <= 1.0.7 - Reflected XSS (medium 5.4)
- [CVE-2024-13098](https://insights.sbomify.com/CVE-2024-13098/): WP Email Newsletter <= 1.1 - Reflected XSS (medium 5.4)
- [CVE-2024-13097](https://insights.sbomify.com/CVE-2024-13097/): WP Finance <= 1.3.6 - Reflected XSS (medium 5.4)
- [CVE-2024-13096](https://insights.sbomify.com/CVE-2024-13096/): WP Finance <= 1.3.6 - Stored XSS via CSRF (medium 4.6)
- [CVE-2024-13095](https://insights.sbomify.com/CVE-2024-13095/): WP Triggers Lite <= 2.5.3 - Admin+ SQL Injection (medium 4.8)
- [CVE-2024-13094](https://insights.sbomify.com/CVE-2024-13094/): WP Triggers Lite <= 2.5.3 - Reflected XSS (high 7.1)
- [CVE-2024-13093](https://insights.sbomify.com/CVE-2024-13093/): code-projects Job Recruitment Seeker Profile _call_main_search_ajax.php sql injection (medium 5.3)
- [CVE-2024-13092](https://insights.sbomify.com/CVE-2024-13092/): code-projects Job Recruitment Job Post search_ajax.php sql injection (medium 5.3)
- [CVE-2024-13091](https://insights.sbomify.com/CVE-2024-13091/): WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-13090](https://insights.sbomify.com/CVE-2024-13090/): Privilege escalation in Guardian/CMC before 24.6.0 (high 7.3)
- [CVE-2024-1309](https://insights.sbomify.com/CVE-2024-1309/): Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5 (medium 6.5)
- [CVE-2024-13089](https://insights.sbomify.com/CVE-2024-13089/): Authenticated RCE in update functionality in Guardian/CMC before 24.6.0 (high 7.5)
- [CVE-2024-13088](https://insights.sbomify.com/CVE-2024-13088/): QHora (medium 5.2)
- [CVE-2024-13087](https://insights.sbomify.com/CVE-2024-13087/): QHora (low 2.4)
- [CVE-2024-13086](https://insights.sbomify.com/CVE-2024-13086/): QTS, QuTS hero (medium 5.3)
- [CVE-2024-13085](https://insights.sbomify.com/CVE-2024-13085/): PHPGurukul Land Record System login.php sql injection (medium 6.9)
- [CVE-2024-13084](https://insights.sbomify.com/CVE-2024-13084/): PHPGurukul Land Record System search-property.php sql injection (medium 5.3)
- [CVE-2024-13083](https://insights.sbomify.com/CVE-2024-13083/): PHPGurukul Land Record System admin-profile.php cross site scripting (medium 5.3)
- [CVE-2024-13082](https://insights.sbomify.com/CVE-2024-13082/): PHPGurukul Land Record System search-property.php cross site scripting (medium 5.3)
- [CVE-2024-13081](https://insights.sbomify.com/CVE-2024-13081/): PHPGurukul Land Record System contactus.php cross site scripting (medium 5.3)
- [CVE-2024-13080](https://insights.sbomify.com/CVE-2024-13080/): PHPGurukul Land Record System aboutus.php cross site scripting (medium 5.1)
- [CVE-2024-1308](https://insights.sbomify.com/CVE-2024-1308/): WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification (high 7.5)
- [CVE-2024-13079](https://insights.sbomify.com/CVE-2024-13079/): PHPGurukul Land Record System property-details.php sql injection (medium 5.3)
- [CVE-2024-13078](https://insights.sbomify.com/CVE-2024-13078/): PHPGurukul Land Record System index.php sql injection (medium 5.3)
- [CVE-2024-13077](https://insights.sbomify.com/CVE-2024-13077/): PHPGurukul Land Record System add-property.php cross site scripting (medium 5.3)
- [CVE-2024-13076](https://insights.sbomify.com/CVE-2024-13076/): PHPGurukul Land Record System edit-propertytype.php cross site scripting (medium 5.3)
- [CVE-2024-13075](https://insights.sbomify.com/CVE-2024-13075/): PHPGurukul Land Record System add-propertytype.php cross site scripting (medium 5.3)
- [CVE-2024-13074](https://insights.sbomify.com/CVE-2024-13074/): PHPGurukul Land Record System index.php cross site scripting (medium 5.3)
- [CVE-2024-13073](https://insights.sbomify.com/CVE-2024-13073/): XSS in Akinsoft's TaskPano (medium 4.7)
- [CVE-2024-13072](https://insights.sbomify.com/CVE-2024-13072/): 1000 Projects Beauty Parlour Management System Customer Detail add-customer-services.php sql injection (medium 5.3)
- [CVE-2024-13071](https://insights.sbomify.com/CVE-2024-13071/): XSS in Akinsoft's e-Mutabakat (medium 4.3)
- [CVE-2024-13070](https://insights.sbomify.com/CVE-2024-13070/): CodeAstro Online Food Ordering System Update User Page update_users.php sql injection (medium 5.3)
- [CVE-2024-1307](https://insights.sbomify.com/CVE-2024-1307/): Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control (medium 6.5)
- [CVE-2024-13069](https://insights.sbomify.com/CVE-2024-13069/): SourceCodester Multi Role Login System add-user.php cross site scripting (medium 5.3)
- [CVE-2024-13068](https://insights.sbomify.com/CVE-2024-13068/): Host Header Injection in Akinsoft's LimonDesk (high 7.3)
- [CVE-2024-13067](https://insights.sbomify.com/CVE-2024-13067/): CodeAstro Online Food Ordering System All Users Page all_users.php access control (medium 6.9)
- [CVE-2024-13066](https://insights.sbomify.com/CVE-2024-13066/): iFrame Injection in Akinsoft's LimonDesk (medium 4.3)
- [CVE-2024-13065](https://insights.sbomify.com/CVE-2024-13065/): Business Logic Error in Akinsoft's MyRezzta (medium 6.3)
- [CVE-2024-13064](https://insights.sbomify.com/CVE-2024-13064/): XSS in Akinsoft's MyRezzta (medium 4.3)
- [CVE-2024-13063](https://insights.sbomify.com/CVE-2024-13063/): IDOR in Akinsoft's MyRezzta (medium 6.8)
- [CVE-2024-13062](https://insights.sbomify.com/CVE-2024-13062/): Command injection in Router (high 7.2)
- [CVE-2024-13061](https://insights.sbomify.com/CVE-2024-13061/): 2100 Technology Electronic Official Document Management System - Authentication Bypass (critical 9.8)
- [CVE-2024-13060](https://insights.sbomify.com/CVE-2024-13060/): Improper Authorization in mintplex-labs/anything-llm (medium 4.3)
- [CVE-2024-1306](https://insights.sbomify.com/CVE-2024-1306/): Smart Forms < 2.6.94 - Edit Entries via CSRF (medium 5.4)
- [CVE-2024-13059](https://insights.sbomify.com/CVE-2024-13059/): Path Traversal in mintplex-labs/anything-llm (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/480/