# Vulnerabilities published in 2024


- [CVE-2024-12869](https://insights.sbomify.com/CVE-2024-12869/): Improper Authentication in infiniflow/ragflow (medium 4.3)
- [CVE-2024-12867](https://insights.sbomify.com/CVE-2024-12867/): Server-side request forgery in Arctic Hub (high 8.8)
- [CVE-2024-12866](https://insights.sbomify.com/CVE-2024-12866/): Local File Inclusion in netease-youdao/qanything (high 7.5)
- [CVE-2024-12864](https://insights.sbomify.com/CVE-2024-12864/): Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything (high 7.5)
- [CVE-2024-12863](https://insights.sbomify.com/CVE-2024-12863/): Stored XSS in Discussions functionality (medium 5.6)
- [CVE-2024-12862](https://insights.sbomify.com/CVE-2024-12862/): REST API allows users without permissions to remove external collaborators (medium 5.5)
- [CVE-2024-12861](https://insights.sbomify.com/CVE-2024-12861/): Path traversal in W2S – Migrate WooCommerce to Shopify (medium 6.5)
- [CVE-2024-12860](https://insights.sbomify.com/CVE-2024-12860/): CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover (critical 9.8)
- [CVE-2024-1286](https://insights.sbomify.com/CVE-2024-1286/): Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure (medium 4.9)
- [CVE-2024-12859](https://insights.sbomify.com/CVE-2024-12859/): BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode (high 8.8)
- [CVE-2024-12857](https://insights.sbomify.com/CVE-2024-12857/): AdForest <= 5.1.8 - Authentication Bypass (critical 9.8)
- [CVE-2024-12856](https://insights.sbomify.com/CVE-2024-12856/): Four-Faith Industrial Router adjust_sys_time OS Command Injection (high 7.2)
- [CVE-2024-12855](https://insights.sbomify.com/CVE-2024-12855/): Missing authorization in AdForest (medium 4.3)
- [CVE-2024-12854](https://insights.sbomify.com/CVE-2024-12854/): Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2024-12853](https://insights.sbomify.com/CVE-2024-12853/): Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2024-12852](https://insights.sbomify.com/CVE-2024-12852/): Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12851](https://insights.sbomify.com/CVE-2024-12851/): Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12850](https://insights.sbomify.com/CVE-2024-12850/): Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read (medium 4.9)
- [CVE-2024-1285](https://insights.sbomify.com/CVE-2024-1285/): Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing (medium 6.5)
- [CVE-2024-12849](https://insights.sbomify.com/CVE-2024-12849/): Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read (high 7.5)
- [CVE-2024-12848](https://insights.sbomify.com/CVE-2024-12848/): SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-12847](https://insights.sbomify.com/CVE-2024-12847/): NETGEAR DGN setup.cgi OS Command Injection (critical 9.8)
- [CVE-2024-12846](https://insights.sbomify.com/CVE-2024-12846/): Emlog Pro link.php cross site scripting (medium 6.9)
- [CVE-2024-12845](https://insights.sbomify.com/CVE-2024-12845/): Emlog Pro common.php cross site scripting (medium 5.3)
- [CVE-2024-12844](https://insights.sbomify.com/CVE-2024-12844/): Emlog Pro store.php cross site scripting (medium 6.9)
- [CVE-2024-12843](https://insights.sbomify.com/CVE-2024-12843/): Emlog Pro plugin.php cross site scripting (medium 6.9)
- [CVE-2024-12842](https://insights.sbomify.com/CVE-2024-12842/): Emlog Pro user.php cross site scripting (medium 6.9)
- [CVE-2024-12841](https://insights.sbomify.com/CVE-2024-12841/): Emlog Pro tag.php cross site scripting (medium 6.9)
- [CVE-2024-1284](https://insights.sbomify.com/CVE-2024-1284/): Use after free in Chrome (critical 9.8)
- [CVE-2024-12839](https://insights.sbomify.com/CVE-2024-12839/): Changing Information Technology CGFIDO - Authentication Bypass (high 8.8)
- [CVE-2024-12838](https://insights.sbomify.com/CVE-2024-12838/): Changing Information Technology CGFIDO - Authentication Bypass (high 8.8)
- [CVE-2024-12837](https://insights.sbomify.com/CVE-2024-12837/): GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size (high 7.8)
- [CVE-2024-12836](https://insights.sbomify.com/CVE-2024-12836/): Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12835](https://insights.sbomify.com/CVE-2024-12835/): Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12834](https://insights.sbomify.com/CVE-2024-12834/): Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12833](https://insights.sbomify.com/CVE-2024-12833/): Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability (high 8.0)
- [CVE-2024-12832](https://insights.sbomify.com/CVE-2024-12832/): Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability (high 8.3)
- [CVE-2024-12831](https://insights.sbomify.com/CVE-2024-12831/): Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability (medium 6.6)
- [CVE-2024-12830](https://insights.sbomify.com/CVE-2024-12830/): Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-1283](https://insights.sbomify.com/CVE-2024-1283/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-12829](https://insights.sbomify.com/CVE-2024-12829/): Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-12828](https://insights.sbomify.com/CVE-2024-12828/): Webmin CGI Command Injection Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2024-12827](https://insights.sbomify.com/CVE-2024-12827/): DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset (critical 9.8)
- [CVE-2024-12826](https://insights.sbomify.com/CVE-2024-12826/): GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update (medium 4.3)
- [CVE-2024-12825](https://insights.sbomify.com/CVE-2024-12825/): Missing authorization in Custom Related Posts (medium 5.4)
- [CVE-2024-12824](https://insights.sbomify.com/CVE-2024-12824/): Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change (critical 9.8)
- [CVE-2024-12822](https://insights.sbomify.com/CVE-2024-12822/): Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2024-12821](https://insights.sbomify.com/CVE-2024-12821/): Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-12820](https://insights.sbomify.com/CVE-2024-12820/): MK Google Directions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1282](https://insights.sbomify.com/CVE-2024-1282/): Cross-site scripting in Email Encoder – Protect Email Addresses and Phone Numbers (medium 6.4)
- [CVE-2024-12819](https://insights.sbomify.com/CVE-2024-12819/): Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12818](https://insights.sbomify.com/CVE-2024-12818/): WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12817](https://insights.sbomify.com/CVE-2024-12817/): Etsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12816](https://insights.sbomify.com/CVE-2024-12816/): NOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12815](https://insights.sbomify.com/CVE-2024-12815/): Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12814](https://insights.sbomify.com/CVE-2024-12814/): Loan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12813](https://insights.sbomify.com/CVE-2024-12813/): Open Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12812](https://insights.sbomify.com/CVE-2024-12812/): WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information (high 7.5)
- [CVE-2024-12811](https://insights.sbomify.com/CVE-2024-12811/): Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode (high 8.8)
- [CVE-2024-12810](https://insights.sbomify.com/CVE-2024-12810/): Missing authorization in JobCareer | Job Board Responsive WordPress Theme (high 8.8)
- [CVE-2024-12809](https://insights.sbomify.com/CVE-2024-12809/): Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12808](https://insights.sbomify.com/CVE-2024-12808/): WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12807](https://insights.sbomify.com/CVE-2024-12807/): Social Share Buttons for WordPress <= 2.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12806](https://insights.sbomify.com/CVE-2024-12806/): Path traversal in SonicOS (medium 4.9)
- [CVE-2024-12805](https://insights.sbomify.com/CVE-2024-12805/): Memory corruption in SonicOS (high 7.2)
- [CVE-2024-12803](https://insights.sbomify.com/CVE-2024-12803/): Memory corruption in SonicOS (high 7.2)
- [CVE-2024-12802](https://insights.sbomify.com/CVE-2024-12802/): Auth bypass in SonicOS (critical 9.1)
- [CVE-2024-12801](https://insights.sbomify.com/CVE-2024-12801/): SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks (low 2.4)
- [CVE-2024-12800](https://insights.sbomify.com/CVE-2024-12800/): IP Based Login < 2.4.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12799](https://insights.sbomify.com/CVE-2024-12799/): Insufficiently Protected Credentials (critical 10.0)
- [CVE-2024-12798](https://insights.sbomify.com/CVE-2024-12798/): JaninoEventEvaluator vulnerability (medium 5.9)
- [CVE-2024-12797](https://insights.sbomify.com/CVE-2024-12797/): RFC7250 handshakes with unauthenticated servers don't abort as expected (medium 6.3)
- [CVE-2024-12796](https://insights.sbomify.com/CVE-2024-12796/): Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP (medium 5.3)
- [CVE-2024-12794](https://insights.sbomify.com/CVE-2024-12794/): Codezips E-Commerce Site editorder.php sql injection (medium 5.3)
- [CVE-2024-12793](https://insights.sbomify.com/CVE-2024-12793/): PbootCMS IndexController.php path traversal (medium 5.3)
- [CVE-2024-12792](https://insights.sbomify.com/CVE-2024-12792/): Codezips E-Commerce Site newadmin.php sql injection (medium 6.9)
- [CVE-2024-12791](https://insights.sbomify.com/CVE-2024-12791/): Codezips E-Commerce Site signin.php sql injection (medium 6.9)
- [CVE-2024-12790](https://insights.sbomify.com/CVE-2024-12790/): code-projects Hostel Management Site room-details.php cross site scripting (medium 5.3)
- [CVE-2024-1279](https://insights.sbomify.com/CVE-2024-1279/): Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure (medium 4.3)
- [CVE-2024-12789](https://insights.sbomify.com/CVE-2024-12789/): PbootCMS IndexController.php code injection (medium 5.3)
- [CVE-2024-12788](https://insights.sbomify.com/CVE-2024-12788/): Codezips Technical Discussion Forum signinpost.php sql injection (medium 6.9)
- [CVE-2024-12787](https://insights.sbomify.com/CVE-2024-12787/): 1000 Projects Attendance Tracking Management System check_student_login.php sql injection (medium 6.9)
- [CVE-2024-12786](https://insights.sbomify.com/CVE-2024-12786/): Privilege escalation in Adobe Downloader (high 8.5)
- [CVE-2024-12785](https://insights.sbomify.com/CVE-2024-12785/): itsourcecode Vehicle Management System sendmail.php sql injection (medium 5.3)
- [CVE-2024-12784](https://insights.sbomify.com/CVE-2024-12784/): itsourcecode Vehicle Management System editbill.php sql injection (medium 5.3)
- [CVE-2024-12783](https://insights.sbomify.com/CVE-2024-12783/): itsourcecode Vehicle Management System billaction.php cross site scripting (medium 5.3)
- [CVE-2024-12782](https://insights.sbomify.com/CVE-2024-12782/): Missing authorization in Apeos C3070 (medium 6.9)
- [CVE-2024-12781](https://insights.sbomify.com/CVE-2024-12781/): Missing authorization in Aurum - WordPress & WooCommerce Shopping Theme (medium 4.3)
- [CVE-2024-1278](https://insights.sbomify.com/CVE-2024-1278/): Cross-site scripting in Easy Social Feed – Social Photos Gallery and Post Feed for WordPress (medium 6.4)
- [CVE-2024-12779](https://insights.sbomify.com/CVE-2024-12779/): SSRF in infiniflow/ragflow (medium 6.5)
- [CVE-2024-12778](https://insights.sbomify.com/CVE-2024-12778/): Denial of Service in aimhubio/aim (high 7.5)
- [CVE-2024-12777](https://insights.sbomify.com/CVE-2024-12777/): Denial of Service in aimhubio/aim (medium 5.9)
- [CVE-2024-12776](https://insights.sbomify.com/CVE-2024-12776/): Authentication Bypass in langgenius/dify (high 8.1)
- [CVE-2024-12775](https://insights.sbomify.com/CVE-2024-12775/): SSRF in langgenius/dify (medium 6.5)
- [CVE-2024-12774](https://insights.sbomify.com/CVE-2024-12774/): Altra Side Menu <= 2.0 - Abitrary Menu Deletion via CSRF (medium 6.5)
- [CVE-2024-12773](https://insights.sbomify.com/CVE-2024-12773/): Altra Side Menu <= 2.0 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-12772](https://insights.sbomify.com/CVE-2024-12772/): Ninja Tables < 5.0.17 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-12771](https://insights.sbomify.com/CVE-2024-12771/): eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset (high 8.8)
- [CVE-2024-12770](https://insights.sbomify.com/CVE-2024-12770/): WP ULike < 4.7.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1277](https://insights.sbomify.com/CVE-2024-1277/): Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/483/