# Vulnerabilities published in 2024


- [CVE-2024-12558](https://insights.sbomify.com/CVE-2024-12558/): Missing authorization in WP BASE Booking of Appointments, Services and Events (medium 6.5)
- [CVE-2024-12557](https://insights.sbomify.com/CVE-2024-12557/): Transporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-12556](https://insights.sbomify.com/CVE-2024-12556/): Kibana Prototype Pollution can lead to code injection (high 8.7)
- [CVE-2024-12555](https://insights.sbomify.com/CVE-2024-12555/): SIP Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-12554](https://insights.sbomify.com/CVE-2024-12554/): Peter’s Custom Anti-Spam <= 3.2.3 - Cross-Site Request Forgery via cas_register_post Function (medium 5.4)
- [CVE-2024-12553](https://insights.sbomify.com/CVE-2024-12553/): GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-12552](https://insights.sbomify.com/CVE-2024-12552/): Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability (high 7.0)
- [CVE-2024-12551](https://insights.sbomify.com/CVE-2024-12551/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12550](https://insights.sbomify.com/CVE-2024-12550/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-1255](https://insights.sbomify.com/CVE-2024-1255/): sepidz SepidzDigitalMenu Waiters information disclosure (medium 5.3)
- [CVE-2024-12549](https://insights.sbomify.com/CVE-2024-12549/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12548](https://insights.sbomify.com/CVE-2024-12548/): Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-12547](https://insights.sbomify.com/CVE-2024-12547/): Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12545](https://insights.sbomify.com/CVE-2024-12545/): Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function (medium 5.4)
- [CVE-2024-12544](https://insights.sbomify.com/CVE-2024-12544/): Missing authorization in SurveyJS: Drag & Drop Form Builder (high 8.8)
- [CVE-2024-12543](https://insights.sbomify.com/CVE-2024-12543/): A user enumeration and subsequent data integrity vulnerability affecting barcode functionality (medium 5.9)
- [CVE-2024-12542](https://insights.sbomify.com/CVE-2024-12542/): linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure (high 8.6)
- [CVE-2024-12541](https://insights.sbomify.com/CVE-2024-12541/): Chative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function (medium 5.4)
- [CVE-2024-1254](https://insights.sbomify.com/CVE-2024-1254/): Byzoro Smart S20 Management Platform sysmanageajax.php sql injection (medium 4.7)
- [CVE-2024-12539](https://insights.sbomify.com/CVE-2024-12539/): Elasticsearch Incorrect Authorization (medium 6.0)
- [CVE-2024-12538](https://insights.sbomify.com/CVE-2024-12538/): Duplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication (medium 4.3)
- [CVE-2024-12536](https://insights.sbomify.com/CVE-2024-12536/): SourceCodester Kortex Lite Advocate Office Management System client_data.php cross site scripting (medium 5.3)
- [CVE-2024-12535](https://insights.sbomify.com/CVE-2024-12535/): Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure (high 8.6)
- [CVE-2024-12533](https://insights.sbomify.com/CVE-2024-12533/): Other in SecureCore Technology 4 (low 3.3)
- [CVE-2024-12532](https://insights.sbomify.com/CVE-2024-12532/): BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (medium 4.3)
- [CVE-2024-12530](https://insights.sbomify.com/CVE-2024-12530/): Insecure Dynamic-Link Library (DLL) Load vulnerability (high 7.0)
- [CVE-2024-1253](https://insights.sbomify.com/CVE-2024-1253/): Byzoro Smart S40 Management Platform Import web.php unrestricted upload (medium 4.7)
- [CVE-2024-12529](https://insights.sbomify.com/CVE-2024-12529/): brodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12528](https://insights.sbomify.com/CVE-2024-12528/): Cross-site scripting in WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress (medium 6.4)
- [CVE-2024-12527](https://insights.sbomify.com/CVE-2024-12527/): Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12526](https://insights.sbomify.com/CVE-2024-12526/): Arena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2024-12525](https://insights.sbomify.com/CVE-2024-12525/): Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12524](https://insights.sbomify.com/CVE-2024-12524/): Clinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12523](https://insights.sbomify.com/CVE-2024-12523/): States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12522](https://insights.sbomify.com/CVE-2024-12522/): Cross-site scripting in Yay! Forms (medium 6.4)
- [CVE-2024-12521](https://insights.sbomify.com/CVE-2024-12521/): Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12520](https://insights.sbomify.com/CVE-2024-12520/): Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1252](https://insights.sbomify.com/CVE-2024-1252/): Tongda OA 2017 delete.php sql injection (medium 5.5)
- [CVE-2024-12519](https://insights.sbomify.com/CVE-2024-12519/): TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12518](https://insights.sbomify.com/CVE-2024-12518/): shMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12517](https://insights.sbomify.com/CVE-2024-12517/): WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12516](https://insights.sbomify.com/CVE-2024-12516/): Coupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12515](https://insights.sbomify.com/CVE-2024-12515/): Muslim Prayer Time-Salah/Iqamah <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12514](https://insights.sbomify.com/CVE-2024-12514/): 3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12513](https://insights.sbomify.com/CVE-2024-12513/): Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12512](https://insights.sbomify.com/CVE-2024-12512/): Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12511](https://insights.sbomify.com/CVE-2024-12511/): SMB/FTP Address Book Scan Pass-back attack (high 7.6)
- [CVE-2024-12510](https://insights.sbomify.com/CVE-2024-12510/): LDAP Authentication Sever Pass-back attack (medium 6.7)
- [CVE-2024-1251](https://insights.sbomify.com/CVE-2024-1251/): Tongda OA 2017 delete.php sql injection (medium 5.5)
- [CVE-2024-12509](https://insights.sbomify.com/CVE-2024-12509/): Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12508](https://insights.sbomify.com/CVE-2024-12508/): Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12507](https://insights.sbomify.com/CVE-2024-12507/): Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12506](https://insights.sbomify.com/CVE-2024-12506/): NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12505](https://insights.sbomify.com/CVE-2024-12505/): Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12504](https://insights.sbomify.com/CVE-2024-12504/): Cross-site scripting in Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP (medium 6.4)
- [CVE-2024-12503](https://insights.sbomify.com/CVE-2024-12503/): ClassCMS Model Management Page admin cross site scripting (medium 5.1)
- [CVE-2024-12502](https://insights.sbomify.com/CVE-2024-12502/): My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12501](https://insights.sbomify.com/CVE-2024-12501/): Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12500](https://insights.sbomify.com/CVE-2024-12500/): Philantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1250](https://insights.sbomify.com/CVE-2024-1250/): Privilege Chaining in GitLab (medium 6.5)
- [CVE-2024-12499](https://insights.sbomify.com/CVE-2024-12499/): WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12497](https://insights.sbomify.com/CVE-2024-12497/): 1000 Projects Attendance Tracking Management System check_admin_login.php sql injection (medium 6.9)
- [CVE-2024-12496](https://insights.sbomify.com/CVE-2024-12496/): Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12495](https://insights.sbomify.com/CVE-2024-12495/): Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12494](https://insights.sbomify.com/CVE-2024-12494/): BMLT Meeting Map <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12493](https://insights.sbomify.com/CVE-2024-12493/): Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12492](https://insights.sbomify.com/CVE-2024-12492/): code-projects Farmacia visualizar-usuario.php sql injection (medium 5.3)
- [CVE-2024-12491](https://insights.sbomify.com/CVE-2024-12491/): SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12490](https://insights.sbomify.com/CVE-2024-12490/): code-projects Online Class and Exam Scheduling System teacher_save.php sql injection (medium 5.3)
- [CVE-2024-1249](https://insights.sbomify.com/CVE-2024-1249/): Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos (high 7.4)
- [CVE-2024-12489](https://insights.sbomify.com/CVE-2024-12489/): code-projects Online Class and Exam Scheduling System term.php sql injection (medium 5.3)
- [CVE-2024-12488](https://insights.sbomify.com/CVE-2024-12488/): code-projects Online Class and Exam Scheduling System subject_update.php sql injection (medium 5.3)
- [CVE-2024-12487](https://insights.sbomify.com/CVE-2024-12487/): code-projects Online Class and Exam Scheduling System room_update.php sql injection (medium 5.3)
- [CVE-2024-12486](https://insights.sbomify.com/CVE-2024-12486/): code-projects Online Class and Exam Scheduling System rank_update.php sql injection (medium 5.3)
- [CVE-2024-12485](https://insights.sbomify.com/CVE-2024-12485/): code-projects Online Class and Exam Scheduling System department.php sql injection (medium 5.3)
- [CVE-2024-12484](https://insights.sbomify.com/CVE-2024-12484/): Codezips Technical Discussion Forum signuppost.php sql injection (medium 6.9)
- [CVE-2024-12483](https://insights.sbomify.com/CVE-2024-12483/): Dromara UJCMS User ID id authorization (medium 6.3)
- [CVE-2024-12482](https://insights.sbomify.com/CVE-2024-12482/): cjbi wetech-cms Database Backup BackupFileUtil.java backup path traversal (medium 5.3)
- [CVE-2024-12481](https://insights.sbomify.com/CVE-2024-12481/): cjbi wetech-cms UserDao.java findUser sql injection (medium 5.3)
- [CVE-2024-12480](https://insights.sbomify.com/CVE-2024-12480/): cjbi wetech-cms TopicDao.java searchTopic sql injection (medium 5.3)
- [CVE-2024-1248](https://insights.sbomify.com/CVE-2024-1248/): Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation (medium 4.8)
- [CVE-2024-12479](https://insights.sbomify.com/CVE-2024-12479/): cjbi wetech-cms TopicDao.java searchTopicByKeyword sql injection (medium 5.3)
- [CVE-2024-12478](https://insights.sbomify.com/CVE-2024-12478/): InvoicePlane 1 upload_file unrestricted upload (medium 5.3)
- [CVE-2024-12477](https://insights.sbomify.com/CVE-2024-12477/): Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (medium 6.4)
- [CVE-2024-12476](https://insights.sbomify.com/CVE-2024-12476/): XML external entity in Web Designer for BMENOC0311(C) (high 8.4)
- [CVE-2024-12475](https://insights.sbomify.com/CVE-2024-12475/): WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12474](https://insights.sbomify.com/CVE-2024-12474/): GeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12473](https://insights.sbomify.com/CVE-2024-12473/): SQL injection in Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic (medium 6.5)
- [CVE-2024-12472](https://insights.sbomify.com/CVE-2024-12472/): Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure (medium 4.3)
- [CVE-2024-12471](https://insights.sbomify.com/CVE-2024-12471/): File upload in Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator (high 8.8)
- [CVE-2024-12470](https://insights.sbomify.com/CVE-2024-12470/): School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-1247](https://insights.sbomify.com/CVE-2024-1247/): Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field (low 2.0)
- [CVE-2024-12469](https://insights.sbomify.com/CVE-2024-12469/): WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameter (medium 6.1)
- [CVE-2024-12468](https://insights.sbomify.com/CVE-2024-12468/): WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12467](https://insights.sbomify.com/CVE-2024-12467/): Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12466](https://insights.sbomify.com/CVE-2024-12466/): Proofreading <= 1.2.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12465](https://insights.sbomify.com/CVE-2024-12465/): Property Hive Stamp Duty Calculator <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12464](https://insights.sbomify.com/CVE-2024-12464/): Chatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12463](https://insights.sbomify.com/CVE-2024-12463/): Cross-site scripting in Arena.IM – Live Blogging for real-time events (medium 6.4)
- [CVE-2024-12462](https://insights.sbomify.com/CVE-2024-12462/): YOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/486/