# Vulnerabilities published in 2024


- [CVE-2024-12365](https://insights.sbomify.com/CVE-2024-12365/): W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery (high 8.5)
- [CVE-2024-12364](https://insights.sbomify.com/CVE-2024-12364/): SQLi in Mavi Yeşil Software's Guest Tracking Software (critical 9.8)
- [CVE-2024-12363](https://insights.sbomify.com/CVE-2024-12363/): Insufficient permissions in the TeamViewer Patch & Asset Management component (high 7.1)
- [CVE-2024-12362](https://insights.sbomify.com/CVE-2024-12362/): InvoicePlane invoices.php download path traversal (medium 5.3)
- [CVE-2024-12360](https://insights.sbomify.com/CVE-2024-12360/): code-projects Online Class and Exam Scheduling System class_update.php sql injection (medium 5.3)
- [CVE-2024-1236](https://insights.sbomify.com/CVE-2024-1236/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-12359](https://insights.sbomify.com/CVE-2024-12359/): code-projects Admin Dashboard vendor_management.php cross site scripting (medium 5.3)
- [CVE-2024-12358](https://insights.sbomify.com/CVE-2024-12358/): WeiYe-Jing datax-web add os command injection (medium 5.3)
- [CVE-2024-12357](https://insights.sbomify.com/CVE-2024-12357/): SourceCodester Best House Rental Management System index.php file inclusion (medium 6.9)
- [CVE-2024-12356](https://insights.sbomify.com/CVE-2024-12356/): BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability (critical 9.8, exploited in the wild)
- [CVE-2024-12355](https://insights.sbomify.com/CVE-2024-12355/): SourceCodester Phone Contact Manager System ContactBook.cpp adding input validation (medium 4.8)
- [CVE-2024-12354](https://insights.sbomify.com/CVE-2024-12354/): SourceCodester Phone Contact Manager System User Menu MenuDisplayStart buffer overflow (medium 4.8)
- [CVE-2024-12353](https://insights.sbomify.com/CVE-2024-12353/): SourceCodester Phone Contact Manager System User Menu MenuDisplayStart input validation (medium 4.8)
- [CVE-2024-12352](https://insights.sbomify.com/CVE-2024-12352/): TOTOLINK EX1800T cstecgi.cgi sub_40662C stack-based overflow (medium 5.3)
- [CVE-2024-12351](https://insights.sbomify.com/CVE-2024-12351/): JFinalCMS File Content ContentModel.java findPage sql injection (medium 5.3)
- [CVE-2024-12350](https://insights.sbomify.com/CVE-2024-12350/): JFinalCMS Template TemplateController.java update command injection (medium 5.3)
- [CVE-2024-1235](https://insights.sbomify.com/CVE-2024-1235/): Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12349](https://insights.sbomify.com/CVE-2024-12349/): JFinalCMS save cross-site request forgery (medium 6.9)
- [CVE-2024-12348](https://insights.sbomify.com/CVE-2024-12348/): Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting (medium 5.3)
- [CVE-2024-12347](https://insights.sbomify.com/CVE-2024-12347/): Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization (medium 6.9)
- [CVE-2024-12346](https://insights.sbomify.com/CVE-2024-12346/): Talentera byt_cv_manager cross site scripting (medium 5.3)
- [CVE-2024-12345](https://insights.sbomify.com/CVE-2024-12345/): INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption (medium 6.7)
- [CVE-2024-12344](https://insights.sbomify.com/CVE-2024-12344/): TP-Link VN020 F3v(T) FTP USER Command memory corruption (medium 5.3)
- [CVE-2024-12343](https://insights.sbomify.com/CVE-2024-12343/): TP-Link VN020 F3v(T) SOAP Request WANIPConnection buffer overflow (high 7.1)
- [CVE-2024-12342](https://insights.sbomify.com/CVE-2024-12342/): TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service (high 7.1)
- [CVE-2024-12341](https://insights.sbomify.com/CVE-2024-12341/): Missing authorization in Custom Skins Contact Form 7 (medium 4.3)
- [CVE-2024-12340](https://insights.sbomify.com/CVE-2024-12340/): Information disclosure in Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates (medium 4.3)
- [CVE-2024-1234](https://insights.sbomify.com/CVE-2024-1234/): Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12339](https://insights.sbomify.com/CVE-2024-12339/): Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel' (medium 6.1)
- [CVE-2024-12338](https://insights.sbomify.com/CVE-2024-12338/): Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username (medium 6.1)
- [CVE-2024-12337](https://insights.sbomify.com/CVE-2024-12337/): Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids (medium 6.1)
- [CVE-2024-12336](https://insights.sbomify.com/CVE-2024-12336/): Missing authorization in WC Affiliate – WooCommerce Affiliate Plugin (medium 6.5)
- [CVE-2024-12335](https://insights.sbomify.com/CVE-2024-12335/): Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure (medium 4.3)
- [CVE-2024-12334](https://insights.sbomify.com/CVE-2024-12334/): WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12333](https://insights.sbomify.com/CVE-2024-12333/): WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-12332](https://insights.sbomify.com/CVE-2024-12332/): School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection (medium 6.5)
- [CVE-2024-12331](https://insights.sbomify.com/CVE-2024-12331/): Missing authorization in File Manager Pro – Filester (medium 4.3)
- [CVE-2024-12330](https://insights.sbomify.com/CVE-2024-12330/): Information disclosure in WP Database Backup – Unlimited Database & Files Backup by Backup for WP (high 7.5)
- [CVE-2024-1233](https://insights.sbomify.com/CVE-2024-1233/): Eap: wildfly-elytron has a ssrf security issue (high 7.3)
- [CVE-2024-12329](https://insights.sbomify.com/CVE-2024-12329/): Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure (medium 4.3)
- [CVE-2024-12328](https://insights.sbomify.com/CVE-2024-12328/): MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG (medium 6.4)
- [CVE-2024-12327](https://insights.sbomify.com/CVE-2024-12327/): LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (medium 4.3)
- [CVE-2024-12326](https://insights.sbomify.com/CVE-2024-12326/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau (medium 6.1)
- [CVE-2024-12325](https://insights.sbomify.com/CVE-2024-12325/): Waymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content' (medium 6.1)
- [CVE-2024-12324](https://insights.sbomify.com/CVE-2024-12324/): Unilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page' (medium 6.1)
- [CVE-2024-12323](https://insights.sbomify.com/CVE-2024-12323/): turboSMTP <= 4.6 - Reflected Cross-Site Scripting via 'page' (medium 6.1)
- [CVE-2024-12322](https://insights.sbomify.com/CVE-2024-12322/): ThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2024-12321](https://insights.sbomify.com/CVE-2024-12321/): WC Affiliate <= 2.3.9 - Reflected XSS (high 7.1)
- [CVE-2024-12320](https://insights.sbomify.com/CVE-2024-12320/): Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab' (medium 6.1)
- [CVE-2024-1232](https://insights.sbomify.com/CVE-2024-1232/): CM Download Manager < 2.9.0 - Download Deletion via CSRF (medium 4.8)
- [CVE-2024-12316](https://insights.sbomify.com/CVE-2024-12316/): Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export (medium 5.3)
- [CVE-2024-12315](https://insights.sbomify.com/CVE-2024-12315/): Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory (high 7.5)
- [CVE-2024-12314](https://insights.sbomify.com/CVE-2024-12314/): Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning (high 7.2)
- [CVE-2024-12313](https://insights.sbomify.com/CVE-2024-12313/): Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2024-12312](https://insights.sbomify.com/CVE-2024-12312/): Print Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2024-12311](https://insights.sbomify.com/CVE-2024-12311/): Email Subscribers < 5.7.44 - Admin+ SQL Injection (medium 6.5)
- [CVE-2024-12310](https://insights.sbomify.com/CVE-2024-12310/): Bypass of Login Screen on Shared Kiosk Workstations (high 7.0)
- [CVE-2024-1231](https://insights.sbomify.com/CVE-2024-1231/): CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF (medium 6.8)
- [CVE-2024-12309](https://insights.sbomify.com/CVE-2024-12309/): Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts (medium 5.3)
- [CVE-2024-12308](https://insights.sbomify.com/CVE-2024-12308/): Logo Slider < 4.6.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-12307](https://insights.sbomify.com/CVE-2024-12307/): Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in Unifiedtransform (medium 4.3)
- [CVE-2024-12306](https://insights.sbomify.com/CVE-2024-12306/): Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform (medium 4.3)
- [CVE-2024-12305](https://insights.sbomify.com/CVE-2024-12305/): Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform (medium 4.3)
- [CVE-2024-12304](https://insights.sbomify.com/CVE-2024-12304/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-12303](https://insights.sbomify.com/CVE-2024-12303/): Incorrect Privilege Assignment in GitLab (medium 6.7)
- [CVE-2024-12302](https://insights.sbomify.com/CVE-2024-12302/): Icegram Engage < 3.1.32 - Author+ Stored XSS (medium 6.1)
- [CVE-2024-12301](https://insights.sbomify.com/CVE-2024-12301/): JSP Store Locator <= 1.0 - Deletion via Missing CSRF (medium 6.5)
- [CVE-2024-12300](https://insights.sbomify.com/CVE-2024-12300/): AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload (low 3.7)
- [CVE-2024-1230](https://insights.sbomify.com/CVE-2024-1230/): SimpleShop <= 2.10.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-12299](https://insights.sbomify.com/CVE-2024-12299/): System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter (medium 6.1)
- [CVE-2024-12298](https://insights.sbomify.com/CVE-2024-12298/): Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer (medium 5.5)
- [CVE-2024-12297](https://insights.sbomify.com/CVE-2024-12297/): Frontend Authorization Logic Disclosure Vulnerability (critical 9.2)
- [CVE-2024-12296](https://insights.sbomify.com/CVE-2024-12296/): Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options (high 8.8)
- [CVE-2024-12295](https://insights.sbomify.com/CVE-2024-12295/): Auth bypass in BoomBox Theme Extensions (high 8.8)
- [CVE-2024-12294](https://insights.sbomify.com/CVE-2024-12294/): Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-12293](https://insights.sbomify.com/CVE-2024-12293/): User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation (high 8.8)
- [CVE-2024-12292](https://insights.sbomify.com/CVE-2024-12292/): Insertion of Sensitive Information into Log File in GitLab (medium 4.0)
- [CVE-2024-12291](https://insights.sbomify.com/CVE-2024-12291/): ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12290](https://insights.sbomify.com/CVE-2024-12290/): Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter (medium 6.1)
- [CVE-2024-1229](https://insights.sbomify.com/CVE-2024-1229/): SimpleShop <= 2.10.2 - Missing Authorization (medium 5.3)
- [CVE-2024-12289](https://insights.sbomify.com/CVE-2024-12289/): Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service (medium 5.9)
- [CVE-2024-12288](https://insights.sbomify.com/CVE-2024-12288/): Simple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12287](https://insights.sbomify.com/CVE-2024-12287/): Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user (critical 9.8)
- [CVE-2024-12286](https://insights.sbomify.com/CVE-2024-12286/): MOBATIME Network Master Clock has a use of default credentials vulnerability (critical 9.3)
- [CVE-2024-12285](https://insights.sbomify.com/CVE-2024-12285/): SEMA API <= 5.27 - Reflected Cross-Site Scripting via catid Parameter (medium 6.1)
- [CVE-2024-12284](https://insights.sbomify.com/CVE-2024-12284/): Authenticated privilege escalation (high 8.8)
- [CVE-2024-12283](https://insights.sbomify.com/CVE-2024-12283/): WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter (medium 6.1)
- [CVE-2024-12282](https://insights.sbomify.com/CVE-2024-12282/): WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-12281](https://insights.sbomify.com/CVE-2024-12281/): Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile (critical 9.8)
- [CVE-2024-12280](https://insights.sbomify.com/CVE-2024-12280/): WP Customer Area <= 8.2.4 - Event Log Deletion via CSRF (medium 4.3)
- [CVE-2024-1228](https://insights.sbomify.com/CVE-2024-1228/): Hardcoded password in Eurosoft Przychodnia (critical 9.3)
- [CVE-2024-12279](https://insights.sbomify.com/CVE-2024-12279/): WP Social AutoConnect <= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12278](https://insights.sbomify.com/CVE-2024-12278/): Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-12276](https://insights.sbomify.com/CVE-2024-12276/): Ultimate Member <= 2.9.2 - Authenticated SQL Injection (medium 5.3)
- [CVE-2024-12275](https://insights.sbomify.com/CVE-2024-12275/): CanvasFlow <= 1.5.5 - Reflected XSS (medium 6.1)
- [CVE-2024-12274](https://insights.sbomify.com/CVE-2024-12274/): BookingPress < 1.1.23 - Unauthenticated Export File Download (high 7.5)
- [CVE-2024-12273](https://insights.sbomify.com/CVE-2024-12273/): Calculated Fields Form < 5.2.62 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-12272](https://insights.sbomify.com/CVE-2024-12272/): Path traversal in WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor (high 8.8)
- [CVE-2024-12271](https://insights.sbomify.com/CVE-2024-12271/): 360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-12270](https://insights.sbomify.com/CVE-2024-12270/): Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injection (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/488/