# Vulnerabilities published in 2024


- [CVE-2024-12072](https://insights.sbomify.com/CVE-2024-12072/): Analytics Cat – Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12071](https://insights.sbomify.com/CVE-2024-12071/): Missing authorization in Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media (medium 5.3)
- [CVE-2024-12070](https://insights.sbomify.com/CVE-2024-12070/): Denial of Service in haotian-liu/llava (high 7.5)
- [CVE-2024-1207](https://insights.sbomify.com/CVE-2024-1207/): Booking Calendar <= 9.9 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-12069](https://insights.sbomify.com/CVE-2024-12069/): Lexicata <= 1.0.16 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12068](https://insights.sbomify.com/CVE-2024-12068/): Server-Side Request Forgery in haotian-liu/llava (high 7.5)
- [CVE-2024-12067](https://insights.sbomify.com/CVE-2024-12067/): SQL injection in WP Travel – Ultimate Travel Booking System, Tour Management Engine (medium 6.5)
- [CVE-2024-12066](https://insights.sbomify.com/CVE-2024-12066/): SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.8)
- [CVE-2024-12065](https://insights.sbomify.com/CVE-2024-12065/): Local File Inclusion in haotian-liu/llava (high 7.5)
- [CVE-2024-12063](https://insights.sbomify.com/CVE-2024-12063/): Denial of Service in imartinez/privategpt (high 7.5)
- [CVE-2024-12062](https://insights.sbomify.com/CVE-2024-12062/): Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-12061](https://insights.sbomify.com/CVE-2024-12061/): Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-12060](https://insights.sbomify.com/CVE-2024-12060/): Cross-site scripting in WP Media Optimizer (.webp) (medium 6.1)
- [CVE-2024-1206](https://insights.sbomify.com/CVE-2024-1206/): WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton (high 8.8)
- [CVE-2024-12059](https://insights.sbomify.com/CVE-2024-12059/): ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read (medium 4.3)
- [CVE-2024-12058](https://insights.sbomify.com/CVE-2024-12058/): Path traversal in Connect Secure (medium 6.8)
- [CVE-2024-12057](https://insights.sbomify.com/CVE-2024-12057/): User credentials recorded in log files (low 1.8)
- [CVE-2024-12056](https://insights.sbomify.com/CVE-2024-12056/): Client Secret not checked with OAuth Password grant type (low 2.3)
- [CVE-2024-12055](https://insights.sbomify.com/CVE-2024-12055/): DoS using malicious gguf model file in ollama/ollama (high 7.5)
- [CVE-2024-12054](https://insights.sbomify.com/CVE-2024-12054/): ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness (medium 5.9)
- [CVE-2024-12053](https://insights.sbomify.com/CVE-2024-12053/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-1205](https://insights.sbomify.com/CVE-2024-1205/): File upload in Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring (high 8.8)
- [CVE-2024-12049](https://insights.sbomify.com/CVE-2024-12049/): Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters (medium 6.1)
- [CVE-2024-12048](https://insights.sbomify.com/CVE-2024-12048/): IDOR Vulnerability in transformeroptimus/superagi (high 8.8)
- [CVE-2024-12047](https://insights.sbomify.com/CVE-2024-12047/): Cross-site scripting in WP Compress – Instant Performance & Speed Optimization (medium 6.1)
- [CVE-2024-12046](https://insights.sbomify.com/CVE-2024-12046/): Missing authorization in Medical Addon for Elementor (medium 4.3)
- [CVE-2024-12045](https://insights.sbomify.com/CVE-2024-12045/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 4.4)
- [CVE-2024-12044](https://insights.sbomify.com/CVE-2024-12044/): Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection (critical 9.8)
- [CVE-2024-12043](https://insights.sbomify.com/CVE-2024-12043/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-12042](https://insights.sbomify.com/CVE-2024-12042/): Cross-site scripting in MStore API – Create Native Android & iOS Apps On The Cloud (medium 5.4)
- [CVE-2024-12041](https://insights.sbomify.com/CVE-2024-12041/): Information disclosure in Directorist: AI-Powered Business Directory, Listings & Classified Ads (medium 5.3)
- [CVE-2024-12040](https://insights.sbomify.com/CVE-2024-12040/): Path traversal in Product Carousel Slider & Grid Ultimate for WooCommerce (high 8.8)
- [CVE-2024-1204](https://insights.sbomify.com/CVE-2024-1204/): Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure (medium 4.3)
- [CVE-2024-12039](https://insights.sbomify.com/CVE-2024-12039/): Improper Restriction of Excessive Authentication Attempts in langgenius/dify (high 7.4)
- [CVE-2024-12038](https://insights.sbomify.com/CVE-2024-12038/): Cross-site scripting in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) (medium 6.4)
- [CVE-2024-12037](https://insights.sbomify.com/CVE-2024-12037/): Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12036](https://insights.sbomify.com/CVE-2024-12036/): CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read (high 7.5)
- [CVE-2024-12035](https://insights.sbomify.com/CVE-2024-12035/): CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.8)
- [CVE-2024-12034](https://insights.sbomify.com/CVE-2024-12034/): Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock (medium 5.3)
- [CVE-2024-12033](https://insights.sbomify.com/CVE-2024-12033/): Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync (medium 4.3)
- [CVE-2024-12032](https://insights.sbomify.com/CVE-2024-12032/): SQL injection in Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin (medium 6.5)
- [CVE-2024-12031](https://insights.sbomify.com/CVE-2024-12031/): Advanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-12030](https://insights.sbomify.com/CVE-2024-12030/): MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-1203](https://insights.sbomify.com/CVE-2024-1203/): SQL injection in Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels (high 8.8)
- [CVE-2024-12029](https://insights.sbomify.com/CVE-2024-12029/): Remote Code Execution via Model Deserialization in invoke-ai/invokeai (critical 9.8)
- [CVE-2024-12028](https://insights.sbomify.com/CVE-2024-12028/): Friends <= 3.2.1 - Missing Authorization (medium 5.3)
- [CVE-2024-12027](https://insights.sbomify.com/CVE-2024-12027/): Missing authorization in Message Filter for Contact Form 7 (medium 4.3)
- [CVE-2024-12026](https://insights.sbomify.com/CVE-2024-12026/): Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation (medium 4.3)
- [CVE-2024-12025](https://insights.sbomify.com/CVE-2024-12025/): Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12024](https://insights.sbomify.com/CVE-2024-12024/): Cross-site scripting in EventPrime – Events Calendar, Bookings and Tickets (high 7.2)
- [CVE-2024-12023](https://insights.sbomify.com/CVE-2024-12023/): FULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-12021](https://insights.sbomify.com/CVE-2024-12021/): Stored Cross-Site Scripting (high 8.5)
- [CVE-2024-12020](https://insights.sbomify.com/CVE-2024-12020/): Reflected Cross-Site Scripting (XSS) (medium 6.4)
- [CVE-2024-1202](https://insights.sbomify.com/CVE-2024-1202/): Authentication Bypass in XPodas' Octopod (critical 9.8)
- [CVE-2024-12019](https://insights.sbomify.com/CVE-2024-12019/): Arbitrary File Read via Document API (high 7.1)
- [CVE-2024-12018](https://insights.sbomify.com/CVE-2024-12018/): Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion (medium 4.3)
- [CVE-2024-12016](https://insights.sbomify.com/CVE-2024-12016/): SQLi in CM Informatics' CM News (critical 9.8)
- [CVE-2024-12015](https://insights.sbomify.com/CVE-2024-12015/): SQL Injection in WordPress Project Manager Plugin (high 7.7)
- [CVE-2024-12014](https://insights.sbomify.com/CVE-2024-12014/): Path Traversal vulnerability in eSignaViewer Allow Unauthorized File Access (low 2.0)
- [CVE-2024-12013](https://insights.sbomify.com/CVE-2024-12013/): Hardcoded credentials in 130.8005 (high 7.6)
- [CVE-2024-12012](https://insights.sbomify.com/CVE-2024-12012/): Information disclosure in 130.8005 (medium 5.7)
- [CVE-2024-12011](https://insights.sbomify.com/CVE-2024-12011/): Information disclosure in 130.8005 (high 7.6)
- [CVE-2024-12010](https://insights.sbomify.com/CVE-2024-12010/): Command injection in AX7501-B1 firmware (high 7.2)
- [CVE-2024-1201](https://insights.sbomify.com/CVE-2024-1201/): PanteraSoft HDD Health search path or unquoted item vulnerability (high 7.8)
- [CVE-2024-12009](https://insights.sbomify.com/CVE-2024-12009/): Command injection in EX5601-T1 firmware (high 7.2)
- [CVE-2024-12008](https://insights.sbomify.com/CVE-2024-12008/): W3 Total Cache <= 2.8.1 Information Exposure via Log Files (medium 5.3)
- [CVE-2024-12007](https://insights.sbomify.com/CVE-2024-12007/): code-projects Farmacia visualizar-produto.php sql injection (medium 5.3)
- [CVE-2024-12006](https://insights.sbomify.com/CVE-2024-12006/): Missing authorization in W3 Total Cache (medium 5.3)
- [CVE-2024-12005](https://insights.sbomify.com/CVE-2024-12005/): WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12004](https://insights.sbomify.com/CVE-2024-12004/): WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12003](https://insights.sbomify.com/CVE-2024-12003/): WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-12002](https://insights.sbomify.com/CVE-2024-12002/): Tenda FH451/FH1201/FH1202/FH1206 GetIPTV websReadEvent null pointer dereference (medium 5.3)
- [CVE-2024-12001](https://insights.sbomify.com/CVE-2024-12001/): code-projects Wazifa System Setting updatesettings.php cross site scripting (medium 5.3)
- [CVE-2024-12000](https://insights.sbomify.com/CVE-2024-12000/): code-projects Blood Bank System Setting updatesettings.php cross site scripting (medium 5.3)
- [CVE-2024-1200](https://insights.sbomify.com/CVE-2024-1200/): Jspxcms information disclosure (medium 5.3)
- [CVE-2024-11999](https://insights.sbomify.com/CVE-2024-11999/): Supply chain in Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime (high 8.7)
- [CVE-2024-11998](https://insights.sbomify.com/CVE-2024-11998/): code-projects Farmacia visualizer-forneccedor.chp sql injection (medium 5.3)
- [CVE-2024-11997](https://insights.sbomify.com/CVE-2024-11997/): code-projects Farmacia vendas.php cross site scripting (medium 5.3)
- [CVE-2024-11996](https://insights.sbomify.com/CVE-2024-11996/): code-projects Farmacia editar-fornecedor.php cross site scripting (medium 5.3)
- [CVE-2024-11995](https://insights.sbomify.com/CVE-2024-11995/): code-projects Farmacia pagamento.php cross site scripting (medium 5.3)
- [CVE-2024-11994](https://insights.sbomify.com/CVE-2024-11994/): APM Server Insertion of Sensitive Information into Log File (medium 5.7)
- [CVE-2024-11993](https://insights.sbomify.com/CVE-2024-11993/): Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting (medium 4.6)
- [CVE-2024-11992](https://insights.sbomify.com/CVE-2024-11992/): Path traversal vulnerability in Quick.CMS (critical 9.1)
- [CVE-2024-11991](https://insights.sbomify.com/CVE-2024-11991/): Uninitialized memory access in Motoko incremental garbage collector (medium 5.6)
- [CVE-2024-11990](https://insights.sbomify.com/CVE-2024-11990/): Cross-Site Scripting (XSS) en SurgeMail de NetWin (medium 4.6)
- [CVE-2024-1199](https://insights.sbomify.com/CVE-2024-1199/): CodeAstro Employee Task Management System attendance-info.php denial of service (medium 5.4)
- [CVE-2024-11986](https://insights.sbomify.com/CVE-2024-11986/): Stored XSS in CrushFTP (critical 9.6)
- [CVE-2024-11985](https://insights.sbomify.com/CVE-2024-11985/): Denial of service in RT-AX55 (medium 4.4)
- [CVE-2024-11984](https://insights.sbomify.com/CVE-2024-11984/): SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type (critical 9.4)
- [CVE-2024-11983](https://insights.sbomify.com/CVE-2024-11983/): Billion Electric router - OS Command Injection (high 7.2)
- [CVE-2024-11982](https://insights.sbomify.com/CVE-2024-11982/): Billion Electric router - Plaintext Storage of a Password (high 7.2)
- [CVE-2024-11981](https://insights.sbomify.com/CVE-2024-11981/): Billion Electric router - Authentication Bypass (high 7.5)
- [CVE-2024-11980](https://insights.sbomify.com/CVE-2024-11980/): Billion Electric router - Missing Authentication (high 8.6)
- [CVE-2024-1198](https://insights.sbomify.com/CVE-2024-1198/): openBI Phar User.php addxinzhi deserialization (medium 6.3)
- [CVE-2024-11979](https://insights.sbomify.com/CVE-2024-11979/): Interinfo DreamMaker - Unrestricted File Upload through Path Traversal (critical 9.8)
- [CVE-2024-11978](https://insights.sbomify.com/CVE-2024-11978/): Interinfo DreamMaker - Arbitrary File Reading through Path Traversal (high 7.5)
- [CVE-2024-11977](https://insights.sbomify.com/CVE-2024-11977/): kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-11976](https://insights.sbomify.com/CVE-2024-11976/): BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-11975](https://insights.sbomify.com/CVE-2024-11975/): Reactflow Visitor Recording and Heatmaps <= 1.0.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11974](https://insights.sbomify.com/CVE-2024-11974/): Cross-site scripting in Media Library Assistant (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/491/