# Vulnerabilities published in 2024


- [CVE-2024-11973](https://insights.sbomify.com/CVE-2024-11973/): Quran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters (medium 6.1)
- [CVE-2024-11972](https://insights.sbomify.com/CVE-2024-11972/): Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation (critical 9.8)
- [CVE-2024-11971](https://insights.sbomify.com/CVE-2024-11971/): Guizhou Xiaoma Technology jpress Avatar upload cross site scripting (medium 5.3)
- [CVE-2024-11970](https://insights.sbomify.com/CVE-2024-11970/): code-projects Concert Ticket Ordering System tour(cor).php sql injection (medium 6.9)
- [CVE-2024-1197](https://insights.sbomify.com/CVE-2024-1197/): SourceCodester Testimonial Page Manager HTTP GET Request delete-testimonial.php sql injection (high 7.3)
- [CVE-2024-11969](https://insights.sbomify.com/CVE-2024-11969/): Incorrect default permissions in Cradlepoint NetCloud Exchange (high 8.8)
- [CVE-2024-11968](https://insights.sbomify.com/CVE-2024-11968/): code-projects Farmacia pagamento.php sql injection (medium 5.3)
- [CVE-2024-11967](https://insights.sbomify.com/CVE-2024-11967/): PHPGurukul Complaint Management system reset-password.php sql injection (medium 6.9)
- [CVE-2024-11966](https://insights.sbomify.com/CVE-2024-11966/): PHPGurukul Complaint Management system index.php sql injection (medium 6.9)
- [CVE-2024-11965](https://insights.sbomify.com/CVE-2024-11965/): PHPGurukul Complaint Management system reset-password.php sql injection (medium 6.9)
- [CVE-2024-11964](https://insights.sbomify.com/CVE-2024-11964/): PHPGurukul Complaint Management system index.php sql injection (medium 6.9)
- [CVE-2024-11963](https://insights.sbomify.com/CVE-2024-11963/): code-projects Responsive Hotel Site room.php sql injection (medium 5.3)
- [CVE-2024-11962](https://insights.sbomify.com/CVE-2024-11962/): code-projects Simple Car Rental System login.php sql injection (medium 6.9)
- [CVE-2024-11961](https://insights.sbomify.com/CVE-2024-11961/): Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure (medium 6.9)
- [CVE-2024-11960](https://insights.sbomify.com/CVE-2024-11960/): D-Link DIR-605L formSetPortTr buffer overflow (high 8.7)
- [CVE-2024-1196](https://insights.sbomify.com/CVE-2024-1196/): SourceCodester Testimonial Page Manager HTTP POST Request add-testimonial.php cross site scripting (medium 4.3)
- [CVE-2024-11959](https://insights.sbomify.com/CVE-2024-11959/): D-Link DIR-605L formResetStatistic buffer overflow (high 8.7)
- [CVE-2024-11958](https://insights.sbomify.com/CVE-2024-11958/): SQL Injection in run-llama/llama_index (critical 9.8)
- [CVE-2024-11957](https://insights.sbomify.com/CVE-2024-11957/): Arbitrary Code Execution in WPS Office (critical 9.3)
- [CVE-2024-11956](https://insights.sbomify.com/CVE-2024-11956/): Pimcore customer-data-framework list sql injection (medium 5.1)
- [CVE-2024-11955](https://insights.sbomify.com/CVE-2024-11955/): GLPI index.php redirect (medium 5.3)
- [CVE-2024-11954](https://insights.sbomify.com/CVE-2024-11954/): Pimcore Search Document cross site scripting (medium 5.1)
- [CVE-2024-11952](https://insights.sbomify.com/CVE-2024-11952/): Classic Addons – WPBakery Page Builder <= 3.0 - Authenticated (Contributor+) Limited Local PHP File Inclusion (high 7.5)
- [CVE-2024-11951](https://insights.sbomify.com/CVE-2024-11951/): Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register (critical 9.8)
- [CVE-2024-11950](https://insights.sbomify.com/CVE-2024-11950/): XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-1195](https://insights.sbomify.com/CVE-2024-1195/): iTop VPN IOCTL ITopVpnCallbackProcess.sys denial of service (medium 5.5)
- [CVE-2024-11949](https://insights.sbomify.com/CVE-2024-11949/): GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-11948](https://insights.sbomify.com/CVE-2024-11948/): GFI Archiver Telerik Web UI Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-11947](https://insights.sbomify.com/CVE-2024-11947/): GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-11946](https://insights.sbomify.com/CVE-2024-11946/): iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability (low 3.1)
- [CVE-2024-11945](https://insights.sbomify.com/CVE-2024-11945/): Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (medium 6.4)
- [CVE-2024-11944](https://insights.sbomify.com/CVE-2024-11944/): iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-11943](https://insights.sbomify.com/CVE-2024-11943/): 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Function (medium 6.1)
- [CVE-2024-11942](https://insights.sbomify.com/CVE-2024-11942/): Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 (medium 5.9)
- [CVE-2024-11941](https://insights.sbomify.com/CVE-2024-11941/): Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001 (high 7.5)
- [CVE-2024-11940](https://insights.sbomify.com/CVE-2024-11940/): Cross-site scripting in Property Hive Mortgage Calculator (medium 6.4)
- [CVE-2024-1194](https://insights.sbomify.com/CVE-2024-1194/): Armcode AlienIP Locate Host denial of service (low 3.3)
- [CVE-2024-11939](https://insights.sbomify.com/CVE-2024-11939/): Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data (high 7.5)
- [CVE-2024-11938](https://insights.sbomify.com/CVE-2024-11938/): Cross-site scripting in One Click Upsell Funnel for Woocommerce (medium 6.4)
- [CVE-2024-11937](https://insights.sbomify.com/CVE-2024-11937/): Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11936](https://insights.sbomify.com/CVE-2024-11936/): Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-11935](https://insights.sbomify.com/CVE-2024-11935/): Email Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter (medium 6.4)
- [CVE-2024-11934](https://insights.sbomify.com/CVE-2024-11934/): Cross-site scripting in Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce (medium 6.4)
- [CVE-2024-11933](https://insights.sbomify.com/CVE-2024-11933/): Fuji Electric Monitouch V-SFT X1 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11931](https://insights.sbomify.com/CVE-2024-11931/): Insufficient Granularity of Access Control in GitLab (medium 6.4)
- [CVE-2024-11930](https://insights.sbomify.com/CVE-2024-11930/): Cross-site scripting in Taskbuilder – Project Management & Task Management Tool With Kanban Board (medium 6.4)
- [CVE-2024-1193](https://insights.sbomify.com/CVE-2024-1193/): Navicat MySQL Conecction denial of service (low 3.3)
- [CVE-2024-11929](https://insights.sbomify.com/CVE-2024-11929/): Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11928](https://insights.sbomify.com/CVE-2024-11928/): iChart – Easy Charts and Graphs <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (medium 6.4)
- [CVE-2024-11926](https://insights.sbomify.com/CVE-2024-11926/): Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions (medium 6.5)
- [CVE-2024-11925](https://insights.sbomify.com/CVE-2024-11925/): WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation (critical 9.8)
- [CVE-2024-11924](https://insights.sbomify.com/CVE-2024-11924/): Email Subscribers < 5.7.52 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-11923](https://insights.sbomify.com/CVE-2024-11923/): Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3 (medium 5.5)
- [CVE-2024-11922](https://insights.sbomify.com/CVE-2024-11922/): Input Validation vulnerability in Web Client emails that do not go through Secure Mail (medium 6.3)
- [CVE-2024-11921](https://insights.sbomify.com/CVE-2024-11921/): Give < 3.19.0 - Reflected XSS (medium 4.8)
- [CVE-2024-11920](https://insights.sbomify.com/CVE-2024-11920/): Memory corruption in Chrome (medium 4.3)
- [CVE-2024-1192](https://insights.sbomify.com/CVE-2024-1192/): South River WebDrive New Secure WebDAV denial of service (low 3.3)
- [CVE-2024-11919](https://insights.sbomify.com/CVE-2024-11919/): Other in Chrome (medium 4.3)
- [CVE-2024-11918](https://insights.sbomify.com/CVE-2024-11918/): Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update (medium 4.3)
- [CVE-2024-11917](https://insights.sbomify.com/CVE-2024-11917/): JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins (high 8.1)
- [CVE-2024-11916](https://insights.sbomify.com/CVE-2024-11916/): Missing authorization in The Ultimate WordPress Toolkit – WP Extended (high 7.4)
- [CVE-2024-11915](https://insights.sbomify.com/CVE-2024-11915/): RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-11914](https://insights.sbomify.com/CVE-2024-11914/): Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11913](https://insights.sbomify.com/CVE-2024-11913/): Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery (medium 5.4)
- [CVE-2024-11912](https://insights.sbomify.com/CVE-2024-11912/): Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id (high 7.5)
- [CVE-2024-11911](https://insights.sbomify.com/CVE-2024-11911/): WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation (medium 4.3)
- [CVE-2024-11910](https://insights.sbomify.com/CVE-2024-11910/): WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1191](https://insights.sbomify.com/CVE-2024-1191/): Hyper CdCatalog HCF File denial of service (low 3.3)
- [CVE-2024-11907](https://insights.sbomify.com/CVE-2024-11907/): Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11906](https://insights.sbomify.com/CVE-2024-11906/): TPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11905](https://insights.sbomify.com/CVE-2024-11905/): Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11904](https://insights.sbomify.com/CVE-2024-11904/): 코드엠샵 소셜톡 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11903](https://insights.sbomify.com/CVE-2024-11903/): WP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11902](https://insights.sbomify.com/CVE-2024-11902/): Slope Widgets <= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11901](https://insights.sbomify.com/CVE-2024-11901/): PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11900](https://insights.sbomify.com/CVE-2024-11900/): Cross-site scripting in Portfolio – Filterable Masonry Portfolio Gallery for Professionals (medium 6.4)
- [CVE-2024-1190](https://insights.sbomify.com/CVE-2024-1190/): Global Scape CuteFTP denial of service (low 3.3)
- [CVE-2024-11899](https://insights.sbomify.com/CVE-2024-11899/): Slider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11898](https://insights.sbomify.com/CVE-2024-11898/): Scratch & Win – Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11897](https://insights.sbomify.com/CVE-2024-11897/): Contact Form, Survey & Form Builder – MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11896](https://insights.sbomify.com/CVE-2024-11896/): Cross-site scripting in Text Prompter – Unlimited chatgpt text prompts for openai tasks (medium 6.4)
- [CVE-2024-11895](https://insights.sbomify.com/CVE-2024-11895/): Cross-site scripting in Online Payments – Get Paid with PayPal, Square & Stripe (medium 6.4)
- [CVE-2024-11894](https://insights.sbomify.com/CVE-2024-11894/): The Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11893](https://insights.sbomify.com/CVE-2024-11893/): Cross-site scripting in Spoki – Chat Buttons and WooCommerce Notifications (medium 6.4)
- [CVE-2024-11892](https://insights.sbomify.com/CVE-2024-11892/): Accordion Slider Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11891](https://insights.sbomify.com/CVE-2024-11891/): Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1189](https://insights.sbomify.com/CVE-2024-1189/): AMPPS Encryption Passphrase denial of service (medium 5.3)
- [CVE-2024-11889](https://insights.sbomify.com/CVE-2024-11889/): My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11888](https://insights.sbomify.com/CVE-2024-11888/): IDer Login for WordPress <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11887](https://insights.sbomify.com/CVE-2024-11887/): Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11886](https://insights.sbomify.com/CVE-2024-11886/): Contact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11885](https://insights.sbomify.com/CVE-2024-11885/): NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11884](https://insights.sbomify.com/CVE-2024-11884/): Wp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11883](https://insights.sbomify.com/CVE-2024-11883/): Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11882](https://insights.sbomify.com/CVE-2024-11882/): Cross-site scripting in Awesome FAQ – Modern Accordion, Tabs,Responsive & Super Fast FAQ Builder. (medium 6.4)
- [CVE-2024-11881](https://insights.sbomify.com/CVE-2024-11881/): Easy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11880](https://insights.sbomify.com/CVE-2024-11880/): B Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1188](https://insights.sbomify.com/CVE-2024-1188/): Rizone Soft Notepad3 Encryption Passphrase denial of service (low 3.3)
- [CVE-2024-11878](https://insights.sbomify.com/CVE-2024-11878/): Category Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11877](https://insights.sbomify.com/CVE-2024-11877/): Cricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/492/