# Vulnerabilities published in 2024


- [CVE-2024-11876](https://insights.sbomify.com/CVE-2024-11876/): Cross-site scripting in Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site (medium 6.4)
- [CVE-2024-11875](https://insights.sbomify.com/CVE-2024-11875/): Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11874](https://insights.sbomify.com/CVE-2024-11874/): Grid Accordion Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11873](https://insights.sbomify.com/CVE-2024-11873/): glomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11872](https://insights.sbomify.com/CVE-2024-11872/): Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-11871](https://insights.sbomify.com/CVE-2024-11871/): Social Media Shortcodes <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11870](https://insights.sbomify.com/CVE-2024-11870/): Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1187](https://insights.sbomify.com/CVE-2024-1187/): Munsoft Easy Outlook Express Recovery Registration Key denial of service (low 3.3)
- [CVE-2024-11869](https://insights.sbomify.com/CVE-2024-11869/): Buk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11868](https://insights.sbomify.com/CVE-2024-11868/): LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-11867](https://insights.sbomify.com/CVE-2024-11867/): Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11866](https://insights.sbomify.com/CVE-2024-11866/): BMLT Tabbed Map <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11865](https://insights.sbomify.com/CVE-2024-11865/): Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11864](https://insights.sbomify.com/CVE-2024-11864/): SCP-Firmware Vulnerability (high 7.5)
- [CVE-2024-11863](https://insights.sbomify.com/CVE-2024-11863/): SCP-Firmware Vulnerability (medium 5.3)
- [CVE-2024-11862](https://insights.sbomify.com/CVE-2024-11862/): Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications (medium 5.1)
- [CVE-2024-11861](https://insights.sbomify.com/CVE-2024-11861/): Command injection in EnerSys AMPA 22.09 and prior versions (critical 9.8)
- [CVE-2024-11860](https://insights.sbomify.com/CVE-2024-11860/): SourceCodester Best House Rental Management System POST Request ajax.php improper authorization (medium 6.9)
- [CVE-2024-1186](https://insights.sbomify.com/CVE-2024-1186/): Munsoft Easy Archive Recovery Registration Key denial of service (low 3.3)
- [CVE-2024-11859](https://insights.sbomify.com/CVE-2024-11859/): DLL Search Order Hijacking in ESET products for Windows (high 8.4)
- [CVE-2024-11858](https://insights.sbomify.com/CVE-2024-11858/): Radare2: command injection via pebble application files in radare2 (high 8.6)
- [CVE-2024-11857](https://insights.sbomify.com/CVE-2024-11857/): Realtek Bluetooth HCI Adaptor - Privilege Escalation (high 8.5)
- [CVE-2024-11856](https://insights.sbomify.com/CVE-2024-11856/): HPE IceWall Products, Remote Unauthorized Data Modification (low 3.7)
- [CVE-2024-11855](https://insights.sbomify.com/CVE-2024-11855/): Cross-site scripting in Koalendar – Easy Appointment Scheduling & Booking Plugin (medium 6.4)
- [CVE-2024-11854](https://insights.sbomify.com/CVE-2024-11854/): Cross-site scripting in Listdom: AI-powered Business Directory with Classifieds Ads Listings (medium 6.4)
- [CVE-2024-11853](https://insights.sbomify.com/CVE-2024-11853/): jAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter (medium 6.4)
- [CVE-2024-11852](https://insights.sbomify.com/CVE-2024-11852/): Missing authorization in Element Pack – Widgets, Templates & Addons for Elementor (medium 4.3)
- [CVE-2024-11851](https://insights.sbomify.com/CVE-2024-11851/): NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update (medium 4.3)
- [CVE-2024-11850](https://insights.sbomify.com/CVE-2024-11850/): Stored XSS in langgenius/dify (medium 6.8)
- [CVE-2024-1185](https://insights.sbomify.com/CVE-2024-1185/): Nsasoft NBMonitor Network Bandwidth Monitor Registration denial of service (low 3.3)
- [CVE-2024-11849](https://insights.sbomify.com/CVE-2024-11849/): Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-11848](https://insights.sbomify.com/CVE-2024-11848/): NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (high 8.1)
- [CVE-2024-11847](https://insights.sbomify.com/CVE-2024-11847/): WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVG (medium 4.8)
- [CVE-2024-11846](https://insights.sbomify.com/CVE-2024-11846/): Travel Tour < 5.2.4 - Reflected XSS (medium 6.1)
- [CVE-2024-11844](https://insights.sbomify.com/CVE-2024-11844/): IdeaPush <= 8.71 - Missing Authorization to Board Term Deletion (medium 4.3)
- [CVE-2024-11843](https://insights.sbomify.com/CVE-2024-11843/): Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11842](https://insights.sbomify.com/CVE-2024-11842/): DN Shipping by Weight for WooCommerce < 1.2 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-11841](https://insights.sbomify.com/CVE-2024-11841/): Tithe.ly Giving Button <= 1.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2024-11840](https://insights.sbomify.com/CVE-2024-11840/): Missing authorization in RapidLoad AI – Optimize Web Vitals Automatically (high 7.1)
- [CVE-2024-1184](https://insights.sbomify.com/CVE-2024-1184/): Nsasoft Network Sleuth Registration denial of service (low 3.3)
- [CVE-2024-11839](https://insights.sbomify.com/CVE-2024-11839/): Insecure Deserialization via Runbooks Imports (high 8.6)
- [CVE-2024-11838](https://insights.sbomify.com/CVE-2024-11838/): Local File Inclusion (high 8.6)
- [CVE-2024-11837](https://insights.sbomify.com/CVE-2024-11837/): N1QL Injection (high 8.6)
- [CVE-2024-11836](https://insights.sbomify.com/CVE-2024-11836/): Server-side Request Forgery (high 8.6)
- [CVE-2024-11835](https://insights.sbomify.com/CVE-2024-11835/): Denial of Service (high 7.0)
- [CVE-2024-11834](https://insights.sbomify.com/CVE-2024-11834/): Arbitrary File Write via PTRAC Import (high 8.9)
- [CVE-2024-11833](https://insights.sbomify.com/CVE-2024-11833/): Arbitrary Directory Write via Runbooks Artifact Upload (high 8.9)
- [CVE-2024-11832](https://insights.sbomify.com/CVE-2024-11832/): Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11831](https://insights.sbomify.com/CVE-2024-11831/): Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (medium 5.4)
- [CVE-2024-11830](https://insights.sbomify.com/CVE-2024-11830/): Cross-site scripting in Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer (medium 6.4)
- [CVE-2024-1183](https://insights.sbomify.com/CVE-2024-1183/): SSRF Vulnerability in gradio-app/gradio (medium 6.5)
- [CVE-2024-11829](https://insights.sbomify.com/CVE-2024-11829/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-11828](https://insights.sbomify.com/CVE-2024-11828/): Inefficient Algorithmic Complexity in GitLab (medium 4.3)
- [CVE-2024-11827](https://insights.sbomify.com/CVE-2024-11827/): Cross-site scripting in Out of the Block: OpenStreetMap (medium 6.4)
- [CVE-2024-11826](https://insights.sbomify.com/CVE-2024-11826/): Cross-site scripting in Quill Forms | Conversational Multi Step Forms, Surveys & quizzes (medium 6.4)
- [CVE-2024-11825](https://insights.sbomify.com/CVE-2024-11825/): Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter (medium 6.4)
- [CVE-2024-11824](https://insights.sbomify.com/CVE-2024-11824/): Stored XSS in langgenius/dify (medium 5.8)
- [CVE-2024-11823](https://insights.sbomify.com/CVE-2024-11823/): Folder Gallery <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11822](https://insights.sbomify.com/CVE-2024-11822/): Server-Side Request Forgery (SSRF) in langgenius/dify (medium 6.5)
- [CVE-2024-11821](https://insights.sbomify.com/CVE-2024-11821/): Privilege Escalation in langgenius/dify (medium 4.3)
- [CVE-2024-11820](https://insights.sbomify.com/CVE-2024-11820/): code-projects Crud Operation System add.php cross site scripting (medium 5.3)
- [CVE-2024-1182](https://insights.sbomify.com/CVE-2024-1182/): Other in GENESIS32 (high 7.0)
- [CVE-2024-11819](https://insights.sbomify.com/CVE-2024-11819/): 1000 Projects Portfolio Management System MCA forgot_password_process.php sql injection (medium 6.9)
- [CVE-2024-11818](https://insights.sbomify.com/CVE-2024-11818/): PHPGurukul User Registration & Login and User Management System signup.php sql injection (medium 6.9)
- [CVE-2024-11817](https://insights.sbomify.com/CVE-2024-11817/): PHPGurukul User Registration & Login and User Management System index.php sql injection (medium 6.9)
- [CVE-2024-11816](https://insights.sbomify.com/CVE-2024-11816/): Missing authorization in The Ultimate WordPress Toolkit – WP Extended (high 8.8)
- [CVE-2024-11815](https://insights.sbomify.com/CVE-2024-11815/): Pósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11814](https://insights.sbomify.com/CVE-2024-11814/): Additional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11813](https://insights.sbomify.com/CVE-2024-11813/): Pulsating Chat Button <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11812](https://insights.sbomify.com/CVE-2024-11812/): Wtyczka SeoPilot dla WP <= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11811](https://insights.sbomify.com/CVE-2024-11811/): Feedify – Web Push Notifications <= 2.4.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11810](https://insights.sbomify.com/CVE-2024-11810/): PayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1181](https://insights.sbomify.com/CVE-2024-1181/): Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypass (medium 5.3)
- [CVE-2024-11809](https://insights.sbomify.com/CVE-2024-11809/): Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11808](https://insights.sbomify.com/CVE-2024-11808/): Pingmeter Uptime Monitoring <= 1.0.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11807](https://insights.sbomify.com/CVE-2024-11807/): NPS computy <= 2.8.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11806](https://insights.sbomify.com/CVE-2024-11806/): PKT1 Centro de envios <= 1.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11805](https://insights.sbomify.com/CVE-2024-11805/): Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11804](https://insights.sbomify.com/CVE-2024-11804/): Planaday API <= 11.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11803](https://insights.sbomify.com/CVE-2024-11803/): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11802](https://insights.sbomify.com/CVE-2024-11802/): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11801](https://insights.sbomify.com/CVE-2024-11801/): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11800](https://insights.sbomify.com/CVE-2024-11800/): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-1180](https://insights.sbomify.com/CVE-2024-1180/): TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-11799](https://insights.sbomify.com/CVE-2024-11799/): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11798](https://insights.sbomify.com/CVE-2024-11798/): Fuji Electric Monitouch V-SFT X1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11797](https://insights.sbomify.com/CVE-2024-11797/): Fuji Electric Monitouch V-SFT V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11796](https://insights.sbomify.com/CVE-2024-11796/): Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11795](https://insights.sbomify.com/CVE-2024-11795/): Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11794](https://insights.sbomify.com/CVE-2024-11794/): Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11793](https://insights.sbomify.com/CVE-2024-11793/): Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11792](https://insights.sbomify.com/CVE-2024-11792/): Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11791](https://insights.sbomify.com/CVE-2024-11791/): Fuji Electric Monitouch V-SFT V8C File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11790](https://insights.sbomify.com/CVE-2024-11790/): Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-1179](https://insights.sbomify.com/CVE-2024-1179/): TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-11789](https://insights.sbomify.com/CVE-2024-11789/): Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11788](https://insights.sbomify.com/CVE-2024-11788/): StreamWeasels YouTube Integration <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11787](https://insights.sbomify.com/CVE-2024-11787/): Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11786](https://insights.sbomify.com/CVE-2024-11786/): Login with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11785](https://insights.sbomify.com/CVE-2024-11785/): Integrate Firebase <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/493/