# Vulnerabilities published in 2024


- [CVE-2024-12964](https://insights.sbomify.com/CVE-2024-12964/): 1000 Projects Daily College Class Work Report Book login.php sql injection (medium 6.9)
- [CVE-2024-12963](https://insights.sbomify.com/CVE-2024-12963/): code-projects Job Recruitment _all_edits.php add_xp sql injection (medium 6.9)
- [CVE-2024-12962](https://insights.sbomify.com/CVE-2024-12962/): code-projects Job Recruitment _all_edits.php sql injection (medium 6.9)
- [CVE-2024-12961](https://insights.sbomify.com/CVE-2024-12961/): 1000 Projects Portfolio Management System MCA update_ach_details.php sql injection (medium 6.9)
- [CVE-2024-12960](https://insights.sbomify.com/CVE-2024-12960/): 1000 Projects Portfolio Management System MCA update_edu_details.php sql injection (medium 6.9)
- [CVE-2024-1296](https://insights.sbomify.com/CVE-2024-1296/): Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12959](https://insights.sbomify.com/CVE-2024-12959/): 1000 Projects Portfolio Management System MCA update_personal_details.php sql injection (medium 6.9)
- [CVE-2024-12958](https://insights.sbomify.com/CVE-2024-12958/): 1000 Projects Portfolio Management System MCA update_pro_details.php sql injection (medium 6.9)
- [CVE-2024-12957](https://insights.sbomify.com/CVE-2024-12957/): Missing authorization in Armoury Crate (high 8.4)
- [CVE-2024-12956](https://insights.sbomify.com/CVE-2024-12956/): 1000 Projects Portfolio Management System MCA add_achievement_details.php unrestricted upload (medium 5.3)
- [CVE-2024-12955](https://insights.sbomify.com/CVE-2024-12955/): PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery (medium 6.9)
- [CVE-2024-12954](https://insights.sbomify.com/CVE-2024-12954/): 1000 Projects Portfolio Management System MCA update_ach.php unrestricted upload (medium 5.3)
- [CVE-2024-12953](https://insights.sbomify.com/CVE-2024-12953/): 1000 Projects Portfolio Management System MCA update_pd_process.php unrestricted upload (medium 5.3)
- [CVE-2024-12952](https://insights.sbomify.com/CVE-2024-12952/): melMass comfy_mtb Dependency endpoint.py run_command code injection (medium 5.3)
- [CVE-2024-12951](https://insights.sbomify.com/CVE-2024-12951/): 1000 Projects Portfolio Management System MCA add_personal_details.php unrestricted upload (medium 5.3)
- [CVE-2024-12950](https://insights.sbomify.com/CVE-2024-12950/): code-projects/projectworlds Travel Management System subcat.php sql injection (medium 5.3)
- [CVE-2024-1295](https://insights.sbomify.com/CVE-2024-1295/): The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access (medium 6.5)
- [CVE-2024-12949](https://insights.sbomify.com/CVE-2024-12949/): code-projects Travel Management System package.php sql injection (medium 5.3)
- [CVE-2024-12948](https://insights.sbomify.com/CVE-2024-12948/): code-projects Travel Management System detail.php sql injection (medium 5.3)
- [CVE-2024-12947](https://insights.sbomify.com/CVE-2024-12947/): Codezips Hospital Management System invo.php sql injection (medium 5.3)
- [CVE-2024-12946](https://insights.sbomify.com/CVE-2024-12946/): 1000 Projects Attendance Tracking Management System admin_action.php sql injection (medium 6.9)
- [CVE-2024-12945](https://insights.sbomify.com/CVE-2024-12945/): code-projects Simple Car Rental System account.php sql injection (medium 6.9)
- [CVE-2024-12944](https://insights.sbomify.com/CVE-2024-12944/): CodeAstro House Rental Management System signin.php sql injection (medium 6.9)
- [CVE-2024-12943](https://insights.sbomify.com/CVE-2024-12943/): CodeAstro House Rental Management System ownersignup.php sql injection (medium 6.9)
- [CVE-2024-12942](https://insights.sbomify.com/CVE-2024-12942/): 1000 Projects Portfolio Management System MCA admin_login.php sql injection (medium 6.9)
- [CVE-2024-12941](https://insights.sbomify.com/CVE-2024-12941/): CodeAstro Blood Donor Management System deletedannounce.php sql injection (medium 5.3)
- [CVE-2024-12940](https://insights.sbomify.com/CVE-2024-12940/): 1000 Projects Attendance Tracking Management System student_action.php sql injection (medium 6.9)
- [CVE-2024-1294](https://insights.sbomify.com/CVE-2024-1294/): Information disclosure in Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (medium 5.3)
- [CVE-2024-12939](https://insights.sbomify.com/CVE-2024-12939/): code-projects Job Recruitment _all_edits.php add_edu sql injection (medium 5.3)
- [CVE-2024-12938](https://insights.sbomify.com/CVE-2024-12938/): code-projects Simple Admin Panel updateOrderStatus.php sql injection (medium 5.3)
- [CVE-2024-12937](https://insights.sbomify.com/CVE-2024-12937/): code-projects Simple Admin Panel addVariationController.php sql injection (medium 5.3)
- [CVE-2024-12936](https://insights.sbomify.com/CVE-2024-12936/): code-projects Simple Admin Panel catDeleteController.php sql injection (medium 5.3)
- [CVE-2024-12935](https://insights.sbomify.com/CVE-2024-12935/): code-projects Simple Admin Panel editItemForm.php sql injection (medium 5.3)
- [CVE-2024-12934](https://insights.sbomify.com/CVE-2024-12934/): code-projects Simple Admin Panel updateItemController.php sql injection (medium 5.3)
- [CVE-2024-12933](https://insights.sbomify.com/CVE-2024-12933/): code-projects Simple Admin Panel updateItemController.php cross site scripting (medium 5.3)
- [CVE-2024-12932](https://insights.sbomify.com/CVE-2024-12932/): code-projects Simple Admin Panel addSizeController.php cross site scripting (medium 5.3)
- [CVE-2024-12931](https://insights.sbomify.com/CVE-2024-12931/): code-projects Simple Admin Panel addCatController.php sql injection (medium 5.3)
- [CVE-2024-12930](https://insights.sbomify.com/CVE-2024-12930/): code-projects Simple Admin Panel addCatController.php cross site scripting (medium 5.3)
- [CVE-2024-1293](https://insights.sbomify.com/CVE-2024-1293/): Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12929](https://insights.sbomify.com/CVE-2024-12929/): code-projects Student Management System addCatController.php sql injection (medium 5.3)
- [CVE-2024-12928](https://insights.sbomify.com/CVE-2024-12928/): code-projects Simple Admin Panel sql injection (medium 5.3)
- [CVE-2024-12927](https://insights.sbomify.com/CVE-2024-12927/): 1000 Projects Attendance Tracking Management System check_faculty_login.php sql injection (medium 6.9)
- [CVE-2024-12926](https://insights.sbomify.com/CVE-2024-12926/): Codezips Project Management System advanced.php sql injection (medium 5.3)
- [CVE-2024-12925](https://insights.sbomify.com/CVE-2024-12925/): Host Header Injection in Akinsoft's QR Menu (high 7.3)
- [CVE-2024-12924](https://insights.sbomify.com/CVE-2024-12924/): Open Redirect in Akinsoft's QR Menu (medium 6.3)
- [CVE-2024-12923](https://insights.sbomify.com/CVE-2024-12923/): Photo Station (low 2.0)
- [CVE-2024-12922](https://insights.sbomify.com/CVE-2024-12922/): Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current (critical 9.8)
- [CVE-2024-12921](https://insights.sbomify.com/CVE-2024-12921/): EthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode (medium 6.4)
- [CVE-2024-12920](https://insights.sbomify.com/CVE-2024-12920/): FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions (high 8.8)
- [CVE-2024-1292](https://insights.sbomify.com/CVE-2024-1292/): WPB Show Core < 2.6 - Reflected XSS (medium 4.7)
- [CVE-2024-12919](https://insights.sbomify.com/CVE-2024-12919/): Auth bypass in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (critical 9.8)
- [CVE-2024-12918](https://insights.sbomify.com/CVE-2024-12918/): SQLi in Agito Computer's Health4All (high 8.8)
- [CVE-2024-12917](https://insights.sbomify.com/CVE-2024-12917/): Improper Access Control in Agito Computer's Health4All (high 8.3)
- [CVE-2024-12916](https://insights.sbomify.com/CVE-2024-12916/): SQLi in Agito Computer's Life4All (high 8.8)
- [CVE-2024-12915](https://insights.sbomify.com/CVE-2024-12915/): Reflected XSS in Devinim Software's Modified Koha Library Software (medium 4.6)
- [CVE-2024-12914](https://insights.sbomify.com/CVE-2024-12914/): XSS in Akinsoft's QR Menu (medium 4.3)
- [CVE-2024-12913](https://insights.sbomify.com/CVE-2024-12913/): SQLi in Megatek Communication System's Azora Wireless Network Management (high 8.8)
- [CVE-2024-12912](https://insights.sbomify.com/CVE-2024-12912/): Command injection in Router (high 7.2)
- [CVE-2024-12911](https://insights.sbomify.com/CVE-2024-12911/): SQL Injection in run-llama/llama_index (high 7.1)
- [CVE-2024-12910](https://insights.sbomify.com/CVE-2024-12910/): Denial of Service in run-llama/llama_index (medium 4.2)
- [CVE-2024-1291](https://insights.sbomify.com/CVE-2024-1291/): Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12909](https://insights.sbomify.com/CVE-2024-12909/): SQL Injection to RCE in run-llama/llama_index (critical 10.0)
- [CVE-2024-12908](https://insights.sbomify.com/CVE-2024-12908/): Code injection in Secret Server (medium 6.9)
- [CVE-2024-12907](https://insights.sbomify.com/CVE-2024-12907/): XSS in Kentico 7 (medium 5.3)
- [CVE-2024-12905](https://insights.sbomify.com/CVE-2024-12905/): tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File (high 7.5)
- [CVE-2024-12903](https://insights.sbomify.com/CVE-2024-12903/): Incorrect default permissions in Biamp Evoko Home (high 7.8)
- [CVE-2024-12902](https://insights.sbomify.com/CVE-2024-12902/): Global Wisdom Software ANCHOR - Undocumented Privileged Account (high 8.4)
- [CVE-2024-12901](https://insights.sbomify.com/CVE-2024-12901/): FoxCMS API Endpoint Site.php improper authorization (medium 6.9)
- [CVE-2024-12900](https://insights.sbomify.com/CVE-2024-12900/): FoxCMS Configuration File installdb.php code injection (medium 5.3)
- [CVE-2024-1290](https://insights.sbomify.com/CVE-2024-1290/): Formidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account Takeover (medium 6.5)
- [CVE-2024-12899](https://insights.sbomify.com/CVE-2024-12899/): 1000 Projects Attendance Tracking Management System course_action.php sql injection (medium 6.9)
- [CVE-2024-12898](https://insights.sbomify.com/CVE-2024-12898/): 1000 Projects Attendance Tracking Management System faculty_action.php sql injection (medium 5.3)
- [CVE-2024-12897](https://insights.sbomify.com/CVE-2024-12897/): Intelbras VIP S4320 G2 Web Interface Sha1Account1 path traversal (medium 5.3)
- [CVE-2024-12896](https://insights.sbomify.com/CVE-2024-12896/): Intelbras VIP S4320 G2 Web Interface webCapsConfig information disclosure (medium 6.9)
- [CVE-2024-12895](https://insights.sbomify.com/CVE-2024-12895/): TreasureHuntGame TreasureHunt checkflag.php console_log sql injection (medium 5.3)
- [CVE-2024-12894](https://insights.sbomify.com/CVE-2024-12894/): TreasureHuntGame TreasureHunt acesso.php sql injection (medium 5.3)
- [CVE-2024-12893](https://insights.sbomify.com/CVE-2024-12893/): Portabilis i-Educar Tipo de Usuário Page 2 cross site scripting (medium 5.1)
- [CVE-2024-12892](https://insights.sbomify.com/CVE-2024-12892/): code-projects Online Exam Mastering System sign.php cross site scripting (medium 5.3)
- [CVE-2024-12891](https://insights.sbomify.com/CVE-2024-12891/): code-projects Online Exam Mastering System account.php sql injection (medium 5.3)
- [CVE-2024-12890](https://insights.sbomify.com/CVE-2024-12890/): code-projects Online Exam Mastering System update.php sql injection (medium 5.3)
- [CVE-2024-1289](https://insights.sbomify.com/CVE-2024-1289/): LearnPress <= 4.2.6.3 - Insecure Direct Object Reference (medium 6.5)
- [CVE-2024-12886](https://insights.sbomify.com/CVE-2024-12886/): Out-Of-Memory (OOM) Vulnerability in ollama/ollama (high 7.5)
- [CVE-2024-12885](https://insights.sbomify.com/CVE-2024-12885/): Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion (medium 6.5)
- [CVE-2024-12884](https://insights.sbomify.com/CVE-2024-12884/): Codezips E-Commerce Website login.php sql injection (medium 6.9)
- [CVE-2024-12883](https://insights.sbomify.com/CVE-2024-12883/): code-projects Job Recruitment _email.php cross site scripting (medium 6.9)
- [CVE-2024-12882](https://insights.sbomify.com/CVE-2024-12882/): SSRF in comfyanonymous/comfyui (high 7.5)
- [CVE-2024-12881](https://insights.sbomify.com/CVE-2024-12881/): Missing authorization in PlugVersions – Easily roll back to previous versions of your plugins. (high 8.8)
- [CVE-2024-12880](https://insights.sbomify.com/CVE-2024-12880/): Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow (high 8.1)
- [CVE-2024-1288](https://insights.sbomify.com/CVE-2024-1288/): Schema & Structured Data for WP & AMP <= 1.26 - Missing Authorization to reCaptcha Key Modification (medium 4.3)
- [CVE-2024-12879](https://insights.sbomify.com/CVE-2024-12879/): Missing authorization in WPBot Pro Wordpress Chatbot (medium 4.3)
- [CVE-2024-12878](https://insights.sbomify.com/CVE-2024-12878/): Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS (high 7.1)
- [CVE-2024-12877](https://insights.sbomify.com/CVE-2024-12877/): GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-12876](https://insights.sbomify.com/CVE-2024-12876/): Missing authorization in Golo - City Travel Guide WordPress Theme (critical 9.8)
- [CVE-2024-12875](https://insights.sbomify.com/CVE-2024-12875/): Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download (medium 4.9)
- [CVE-2024-12874](https://insights.sbomify.com/CVE-2024-12874/): Top Comments <= 1.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2024-12873](https://insights.sbomify.com/CVE-2024-12873/): Custom Field Manager <= 1.0 - Reflected XSS Vulnerability (medium 6.1)
- [CVE-2024-12872](https://insights.sbomify.com/CVE-2024-12872/): Zalomení <= 1.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12871](https://insights.sbomify.com/CVE-2024-12871/): Stored Cross-site Scripting (XSS) in infiniflow/ragflow (medium 5.4)
- [CVE-2024-12870](https://insights.sbomify.com/CVE-2024-12870/): Stored Cross-site Scripting (XSS) in infiniflow/ragflow (medium 5.4)
- [CVE-2024-1287](https://insights.sbomify.com/CVE-2024-1287/): Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/482/