# Vulnerabilities published in 2024


- [CVE-2024-1227](https://insights.sbomify.com/CVE-2024-1227/): Multiple vulnerabilities in Rejetto's Http File Server (medium 6.5)
- [CVE-2024-12269](https://insights.sbomify.com/CVE-2024-12269/): Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export (high 7.5)
- [CVE-2024-12268](https://insights.sbomify.com/CVE-2024-12268/): Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12267](https://insights.sbomify.com/CVE-2024-12267/): Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion (medium 5.3)
- [CVE-2024-12266](https://insights.sbomify.com/CVE-2024-12266/): ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization (medium 6.5)
- [CVE-2024-12265](https://insights.sbomify.com/CVE-2024-12265/): Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure (medium 5.3)
- [CVE-2024-12264](https://insights.sbomify.com/CVE-2024-12264/): PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-12263](https://insights.sbomify.com/CVE-2024-12263/): Missing authorization in Child Theme Creator by Orbisius (medium 4.3)
- [CVE-2024-12262](https://insights.sbomify.com/CVE-2024-12262/): Ebook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step' (medium 6.1)
- [CVE-2024-12261](https://insights.sbomify.com/CVE-2024-12261/): SmartEmailing.cz <= 2.2.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12260](https://insights.sbomify.com/CVE-2024-12260/): Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1226](https://insights.sbomify.com/CVE-2024-1226/): Multiple vulnerabilities in Rejetto's Http File Server (high 7.5)
- [CVE-2024-12259](https://insights.sbomify.com/CVE-2024-12259/): CRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation (high 8.8)
- [CVE-2024-12258](https://insights.sbomify.com/CVE-2024-12258/): WP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12257](https://insights.sbomify.com/CVE-2024-12257/): CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12256](https://insights.sbomify.com/CVE-2024-12256/): Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12255](https://insights.sbomify.com/CVE-2024-12255/): Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure (medium 5.3)
- [CVE-2024-12254](https://insights.sbomify.com/CVE-2024-12254/): Unbounded memory buffering in SelectorSocketTransport.writelines() (high 8.7)
- [CVE-2024-12253](https://insights.sbomify.com/CVE-2024-12253/): Missing authorization in Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal (medium 5.4)
- [CVE-2024-12252](https://insights.sbomify.com/CVE-2024-12252/): SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution) (critical 9.8)
- [CVE-2024-12251](https://insights.sbomify.com/CVE-2024-12251/): Improper neutralization special element in hyperlinks (high 7.8)
- [CVE-2024-12250](https://insights.sbomify.com/CVE-2024-12250/): Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure (medium 5.3)
- [CVE-2024-1225](https://insights.sbomify.com/CVE-2024-1225/): QiboSoft QiboCMS X1 Pay.php rmb_pay deserialization (high 7.3)
- [CVE-2024-12249](https://insights.sbomify.com/CVE-2024-12249/): GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection (medium 4.3)
- [CVE-2024-12248](https://insights.sbomify.com/CVE-2024-12248/): Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor (critical 9.3)
- [CVE-2024-12247](https://insights.sbomify.com/CVE-2024-12247/): Improper propagation of permission scheme updates across cluster nodes (medium 4.6)
- [CVE-2024-12245](https://insights.sbomify.com/CVE-2024-12245/): Blind SQL Injection in Logout (high 8.7)
- [CVE-2024-12244](https://insights.sbomify.com/CVE-2024-12244/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2024-12243](https://insights.sbomify.com/CVE-2024-12243/): Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos (medium 5.3)
- [CVE-2024-12240](https://insights.sbomify.com/CVE-2024-12240/): Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter (medium 6.4)
- [CVE-2024-1224](https://insights.sbomify.com/CVE-2024-1224/): Information Disclosure Vulnerability in CDAC USB Pratirodh (high 7.1)
- [CVE-2024-12239](https://insights.sbomify.com/CVE-2024-12239/): PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter (medium 6.1)
- [CVE-2024-12238](https://insights.sbomify.com/CVE-2024-12238/): Code injection in Ninja Forms – The Contact Form Builder That Grows With You (medium 6.3)
- [CVE-2024-12237](https://insights.sbomify.com/CVE-2024-12237/): Server-side request forgery in Photo Gallery Slideshow & Masonry Tiled Gallery (medium 4.3)
- [CVE-2024-12236](https://insights.sbomify.com/CVE-2024-12236/): Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration (medium 6.8)
- [CVE-2024-12235](https://insights.sbomify.com/CVE-2024-12235/): Shenzhen Dashi Tongzhou Information Technology AgileBPM AuthorizationTokenCheckFilter.java doFilter access control (medium 5.3)
- [CVE-2024-12234](https://insights.sbomify.com/CVE-2024-12234/): 1000 Projects Beauty Parlour Management System edit-customer-detailed.php sql injection (medium 6.9)
- [CVE-2024-12233](https://insights.sbomify.com/CVE-2024-12233/): code-projects Online Notice Board Profile Picture registration.php unrestricted upload (medium 6.9)
- [CVE-2024-12232](https://insights.sbomify.com/CVE-2024-12232/): code-projects Simple CRUD Functionality index.php cross site scripting (medium 5.3)
- [CVE-2024-12231](https://insights.sbomify.com/CVE-2024-12231/): CodeZips Project Management System index.php sql injection (medium 6.9)
- [CVE-2024-12230](https://insights.sbomify.com/CVE-2024-12230/): PHPGurukul Complaint Management System subcategory.php sql injection (medium 6.9)
- [CVE-2024-1223](https://insights.sbomify.com/CVE-2024-1223/): Improper authorization controls in PaperCut NG/MF (medium 4.8)
- [CVE-2024-12229](https://insights.sbomify.com/CVE-2024-12229/): PHPGurukul Complaint Management System complaint-search.php sql injection (medium 6.9)
- [CVE-2024-12228](https://insights.sbomify.com/CVE-2024-12228/): PHPGurukul Complaint Management System user-search.php sql injection (medium 6.9)
- [CVE-2024-12227](https://insights.sbomify.com/CVE-2024-12227/): MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference (medium 6.8)
- [CVE-2024-12226](https://insights.sbomify.com/CVE-2024-12226/): Information disclosure in Kubernetes Worker or Kubernetes Agent (medium 6.5)
- [CVE-2024-12225](https://insights.sbomify.com/CVE-2024-12225/): Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass (critical 9.1)
- [CVE-2024-12224](https://insights.sbomify.com/CVE-2024-12224/): idna accepts Punycode labels that do not produce any non-ASCII when decoded (medium 5.1)
- [CVE-2024-12223](https://insights.sbomify.com/CVE-2024-12223/): Stored Cross-site Scripting (XSS) in Nutanix Prism Central (critical 9.3)
- [CVE-2024-12222](https://insights.sbomify.com/CVE-2024-12222/): Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter (medium 6.1)
- [CVE-2024-12221](https://insights.sbomify.com/CVE-2024-12221/): Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter (medium 6.1)
- [CVE-2024-12220](https://insights.sbomify.com/CVE-2024-12220/): SMS for WooCommerce <= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1222](https://insights.sbomify.com/CVE-2024-1222/): Incorrect authorization controls in PaperCut NG/MF APIs (high 8.6)
- [CVE-2024-12219](https://insights.sbomify.com/CVE-2024-12219/): Stop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting (medium 6.1)
- [CVE-2024-12218](https://insights.sbomify.com/CVE-2024-12218/): Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12217](https://insights.sbomify.com/CVE-2024-12217/): Path Traversal in gradio-app/gradio (medium 5.3)
- [CVE-2024-12216](https://insights.sbomify.com/CVE-2024-12216/): Arbitrary File Write via TarSlip in dmlc/gluon-cv (high 7.1)
- [CVE-2024-12215](https://insights.sbomify.com/CVE-2024-12215/): Remote Code Execution in kedro-org/kedro (high 8.8)
- [CVE-2024-12214](https://insights.sbomify.com/CVE-2024-12214/): WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter (medium 6.1)
- [CVE-2024-12213](https://insights.sbomify.com/CVE-2024-12213/): WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register (critical 9.8)
- [CVE-2024-12212](https://insights.sbomify.com/CVE-2024-12212/): Horner Automation Cscape Out-of-bounds Read (high 8.5)
- [CVE-2024-12211](https://insights.sbomify.com/CVE-2024-12211/): Cross-site scripting in Pega Infinity (medium 5.4)
- [CVE-2024-12210](https://insights.sbomify.com/CVE-2024-12210/): Missing authorization in Print Invoice & Delivery Notes for WooCommerce (medium 4.3)
- [CVE-2024-1221](https://insights.sbomify.com/CVE-2024-1221/): Improper access controls on APIs on Linux and macOS in PaperCut NG/MF (low 3.1)
- [CVE-2024-12209](https://insights.sbomify.com/CVE-2024-12209/): WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-12207](https://insights.sbomify.com/CVE-2024-12207/): Toggles Shortcode and Widget <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-12206](https://insights.sbomify.com/CVE-2024-12206/): Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion (medium 4.3)
- [CVE-2024-12205](https://insights.sbomify.com/CVE-2024-12205/): Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12204](https://insights.sbomify.com/CVE-2024-12204/): Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization (medium 5.4)
- [CVE-2024-12203](https://insights.sbomify.com/CVE-2024-12203/): RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-12202](https://insights.sbomify.com/CVE-2024-12202/): Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax (high 8.8)
- [CVE-2024-12201](https://insights.sbomify.com/CVE-2024-12201/): Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation (medium 4.3)
- [CVE-2024-12200](https://insights.sbomify.com/CVE-2024-12200/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-1220](https://insights.sbomify.com/CVE-2024-1220/): NPort W2150A/W2250A Series Web Server Stack-based Buffer Overflow Vulnerability (high 8.2)
- [CVE-2024-12199](https://insights.sbomify.com/CVE-2024-12199/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12198](https://insights.sbomify.com/CVE-2024-12198/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12197](https://insights.sbomify.com/CVE-2024-12197/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12196](https://insights.sbomify.com/CVE-2024-12196/): Missing authorization in Server (medium 6.5)
- [CVE-2024-12195](https://insights.sbomify.com/CVE-2024-12195/): SQL injection in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (medium 6.5)
- [CVE-2024-12194](https://insights.sbomify.com/CVE-2024-12194/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12193](https://insights.sbomify.com/CVE-2024-12193/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12192](https://insights.sbomify.com/CVE-2024-12192/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12191](https://insights.sbomify.com/CVE-2024-12191/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12190](https://insights.sbomify.com/CVE-2024-12190/): Missing authorization in Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder (medium 4.3)
- [CVE-2024-1219](https://insights.sbomify.com/CVE-2024-1219/): Easy Social Feed < 6.5.6 - Contributor+ Stored XSS (medium 5.3)
- [CVE-2024-12189](https://insights.sbomify.com/CVE-2024-12189/): Cross-site scripting in WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder (medium 6.4)
- [CVE-2024-12188](https://insights.sbomify.com/CVE-2024-12188/): 1000 Projects Library Management System stu.php sql injection (medium 6.9)
- [CVE-2024-12187](https://insights.sbomify.com/CVE-2024-12187/): 1000 Projects Library Management System showbook.php sql injection (medium 6.9)
- [CVE-2024-12186](https://insights.sbomify.com/CVE-2024-12186/): code-projects Hotel Management System Available Room hotelnew.c stack-based overflow (medium 4.8)
- [CVE-2024-12185](https://insights.sbomify.com/CVE-2024-12185/): code-projects Hotel Management System Administrator Login Password stack-based overflow (medium 4.8)
- [CVE-2024-12184](https://insights.sbomify.com/CVE-2024-12184/): WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download (medium 5.3)
- [CVE-2024-12183](https://insights.sbomify.com/CVE-2024-12183/): DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting (medium 5.3)
- [CVE-2024-12182](https://insights.sbomify.com/CVE-2024-12182/): DedeCMS soft_add.php cross site scripting (medium 5.3)
- [CVE-2024-12181](https://insights.sbomify.com/CVE-2024-12181/): DedeCMS SWF File uploads_add.php cross site scripting (medium 5.3)
- [CVE-2024-12180](https://insights.sbomify.com/CVE-2024-12180/): DedeCMS article_add.php cross site scripting (medium 5.3)
- [CVE-2024-1218](https://insights.sbomify.com/CVE-2024-1218/): Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization (medium 4.3)
- [CVE-2024-12179](https://insights.sbomify.com/CVE-2024-12179/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12178](https://insights.sbomify.com/CVE-2024-12178/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12177](https://insights.sbomify.com/CVE-2024-12177/): Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12176](https://insights.sbomify.com/CVE-2024-12176/): WordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/489/