# Vulnerabilities published in 2024


- [CVE-2024-11784](https://insights.sbomify.com/CVE-2024-11784/): Cross-site scripting in TicketSource Ticket Shop (medium 6.4)
- [CVE-2024-11783](https://insights.sbomify.com/CVE-2024-11783/): Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11782](https://insights.sbomify.com/CVE-2024-11782/): WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11781](https://insights.sbomify.com/CVE-2024-11781/): Smart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11780](https://insights.sbomify.com/CVE-2024-11780/): Site Search 360 <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1178](https://insights.sbomify.com/CVE-2024-1178/): SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update (medium 5.3)
- [CVE-2024-11779](https://insights.sbomify.com/CVE-2024-11779/): WIP WooCarousel Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11778](https://insights.sbomify.com/CVE-2024-11778/): CanadaHelps Embedded Donation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11777](https://insights.sbomify.com/CVE-2024-11777/): Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11776](https://insights.sbomify.com/CVE-2024-11776/): PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11775](https://insights.sbomify.com/CVE-2024-11775/): Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11774](https://insights.sbomify.com/CVE-2024-11774/): Outdooractive Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11773](https://insights.sbomify.com/CVE-2024-11773/): SQL injection in Cloud Services Application (critical 9.1)
- [CVE-2024-11772](https://insights.sbomify.com/CVE-2024-11772/): Command injection in Cloud Services Application (critical 9.1)
- [CVE-2024-11771](https://insights.sbomify.com/CVE-2024-11771/): Path traversal in Cloud Services Application (medium 5.3)
- [CVE-2024-11770](https://insights.sbomify.com/CVE-2024-11770/): Post Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1177](https://insights.sbomify.com/CVE-2024-1177/): Missing authorization in WP Club Manager – WordPress Sports Club Plugin (medium 5.3)
- [CVE-2024-11769](https://insights.sbomify.com/CVE-2024-11769/): Flower Delivery by Florist One <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11768](https://insights.sbomify.com/CVE-2024-11768/): Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files (medium 5.3)
- [CVE-2024-11767](https://insights.sbomify.com/CVE-2024-11767/): NewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11766](https://insights.sbomify.com/CVE-2024-11766/): Cross-site scripting in GS Books Showcase – Display Books in Grid, Slider & More | Library for WordPress (medium 6.4)
- [CVE-2024-11765](https://insights.sbomify.com/CVE-2024-11765/): Cross-site scripting in GS Portfolio – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more (medium 6.4)
- [CVE-2024-11764](https://insights.sbomify.com/CVE-2024-11764/): Solar Wizard Lite <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11763](https://insights.sbomify.com/CVE-2024-11763/): Plezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11761](https://insights.sbomify.com/CVE-2024-11761/): LegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11760](https://insights.sbomify.com/CVE-2024-11760/): Currency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1176](https://insights.sbomify.com/CVE-2024-1176/): HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update (medium 5.3)
- [CVE-2024-11759](https://insights.sbomify.com/CVE-2024-11759/): Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11758](https://insights.sbomify.com/CVE-2024-11758/): WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11757](https://insights.sbomify.com/CVE-2024-11757/): WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11756](https://insights.sbomify.com/CVE-2024-11756/): Cross-site scripting in SweepWidget – Contests, Giveaways, Sweepstakes & Photo Contests (medium 6.4)
- [CVE-2024-11755](https://insights.sbomify.com/CVE-2024-11755/): IMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11754](https://insights.sbomify.com/CVE-2024-11754/): Booking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11753](https://insights.sbomify.com/CVE-2024-11753/): UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11752](https://insights.sbomify.com/CVE-2024-11752/): Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11751](https://insights.sbomify.com/CVE-2024-11751/): TCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11750](https://insights.sbomify.com/CVE-2024-11750/): ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1175](https://insights.sbomify.com/CVE-2024-1175/): WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment (medium 5.3)
- [CVE-2024-11749](https://insights.sbomify.com/CVE-2024-11749/): App Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11748](https://insights.sbomify.com/CVE-2024-11748/): Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11747](https://insights.sbomify.com/CVE-2024-11747/): Responsive Videos <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11746](https://insights.sbomify.com/CVE-2024-11746/): Cross-site scripting in GS Brands for WooCommerce (medium 6.4)
- [CVE-2024-11745](https://insights.sbomify.com/CVE-2024-11745/): Tenda AC8 SetStaticRouteCfg route_static_check stack-based overflow (high 8.7)
- [CVE-2024-11744](https://insights.sbomify.com/CVE-2024-11744/): 1000 Projects Portfolio Management System MCA register.php sql injection (medium 6.9)
- [CVE-2024-11743](https://insights.sbomify.com/CVE-2024-11743/): SourceCodester Best House Rental Management System POST Request ajax.php cross-site request forgery (medium 6.9)
- [CVE-2024-11742](https://insights.sbomify.com/CVE-2024-11742/): SourceCodester Best House Rental Management System ajax.php cross site scripting (medium 5.3)
- [CVE-2024-11741](https://insights.sbomify.com/CVE-2024-11741/): Grafana Alerting VictorOps integration could be exposed to users with Viewer permission (medium 4.3)
- [CVE-2024-11740](https://insights.sbomify.com/CVE-2024-11740/): Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-1174](https://insights.sbomify.com/CVE-2024-1174/): Memory corruption in HP ThinPro 8.0 (high 8.2)
- [CVE-2024-11739](https://insights.sbomify.com/CVE-2024-11739/): SQLi in Case Informatics' Case ERP (critical 9.8)
- [CVE-2024-11738](https://insights.sbomify.com/CVE-2024-11738/): Rustls: rustls network-reachable panic in `acceptor::accept` (medium 5.3)
- [CVE-2024-11737](https://insights.sbomify.com/CVE-2024-11737/): Denial of service in Modicon Controllers M241 / M251 (critical 9.3)
- [CVE-2024-11736](https://insights.sbomify.com/CVE-2024-11736/): Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables (medium 4.9)
- [CVE-2024-11734](https://insights.sbomify.com/CVE-2024-11734/): Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers (medium 6.5)
- [CVE-2024-11733](https://insights.sbomify.com/CVE-2024-11733/): WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-11732](https://insights.sbomify.com/CVE-2024-11732/): BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter (medium 6.5)
- [CVE-2024-11731](https://insights.sbomify.com/CVE-2024-11731/): Cross-site scripting in Master Slider – Responsive Touch Slider (medium 6.4)
- [CVE-2024-11730](https://insights.sbomify.com/CVE-2024-11730/): KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection (medium 6.5)
- [CVE-2024-1173](https://insights.sbomify.com/CVE-2024-1173/): SQL injection in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support (high 7.2)
- [CVE-2024-11729](https://insights.sbomify.com/CVE-2024-11729/): KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-11728](https://insights.sbomify.com/CVE-2024-11728/): KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-11727](https://insights.sbomify.com/CVE-2024-11727/): Cross-site scripting in NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (medium 4.4)
- [CVE-2024-11726](https://insights.sbomify.com/CVE-2024-11726/): SQL injection in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress (medium 6.5)
- [CVE-2024-11725](https://insights.sbomify.com/CVE-2024-11725/): Missing authorization in SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery (high 8.8)
- [CVE-2024-11724](https://insights.sbomify.com/CVE-2024-11724/): Missing authorization in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent (medium 4.3)
- [CVE-2024-11723](https://insights.sbomify.com/CVE-2024-11723/): kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11722](https://insights.sbomify.com/CVE-2024-11722/): Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection (medium 5.9)
- [CVE-2024-11721](https://insights.sbomify.com/CVE-2024-11721/): Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation (high 8.1)
- [CVE-2024-11720](https://insights.sbomify.com/CVE-2024-11720/): Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-1172](https://insights.sbomify.com/CVE-2024-1172/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.4)
- [CVE-2024-11719](https://insights.sbomify.com/CVE-2024-11719/): tarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-11718](https://insights.sbomify.com/CVE-2024-11718/): tarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSS (medium 5.4)
- [CVE-2024-11717](https://insights.sbomify.com/CVE-2024-11717/): Auth bypass in CTFd (medium 6.3)
- [CVE-2024-11716](https://insights.sbomify.com/CVE-2024-11716/): Business logic in CTFd (medium 5.3)
- [CVE-2024-11715](https://insights.sbomify.com/CVE-2024-11715/): WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation (medium 4.8)
- [CVE-2024-11714](https://insights.sbomify.com/CVE-2024-11714/): WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox() (medium 4.9)
- [CVE-2024-11713](https://insights.sbomify.com/CVE-2024-11713/): WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate() (medium 4.9)
- [CVE-2024-11712](https://insights.sbomify.com/CVE-2024-11712/): WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download (medium 5.3)
- [CVE-2024-11711](https://insights.sbomify.com/CVE-2024-11711/): WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-11710](https://insights.sbomify.com/CVE-2024-11710/): WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2024-1171](https://insights.sbomify.com/CVE-2024-1171/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.4)
- [CVE-2024-11709](https://insights.sbomify.com/CVE-2024-11709/): AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion (medium 4.3)
- [CVE-2024-11708](https://insights.sbomify.com/CVE-2024-11708/): Race condition in Firefox (medium 6.5)
- [CVE-2024-11707](https://insights.sbomify.com/CVE-2024-11707/): My auctions allegro <= 3.6.17 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11706](https://insights.sbomify.com/CVE-2024-11706/): Null dereference in Firefox (medium 6.5)
- [CVE-2024-11705](https://insights.sbomify.com/CVE-2024-11705/): Null dereference in Firefox (critical 9.1)
- [CVE-2024-11704](https://insights.sbomify.com/CVE-2024-11704/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-11703](https://insights.sbomify.com/CVE-2024-11703/): Auth bypass in Firefox (medium 5.7)
- [CVE-2024-11702](https://insights.sbomify.com/CVE-2024-11702/): Information disclosure in Firefox (high 7.5)
- [CVE-2024-11701](https://insights.sbomify.com/CVE-2024-11701/): Other in Firefox (medium 4.3)
- [CVE-2024-11700](https://insights.sbomify.com/CVE-2024-11700/): Security feature bypass in Firefox (high 8.1)
- [CVE-2024-1170](https://insights.sbomify.com/CVE-2024-1170/): Missing authorization in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) (high 8.2)
- [CVE-2024-11699](https://insights.sbomify.com/CVE-2024-11699/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-11698](https://insights.sbomify.com/CVE-2024-11698/): Denial of service in Firefox (critical 9.8)
- [CVE-2024-11697](https://insights.sbomify.com/CVE-2024-11697/): Security feature bypass in Firefox (high 8.8)
- [CVE-2024-11696](https://insights.sbomify.com/CVE-2024-11696/): Security feature bypass in Firefox (medium 5.4)
- [CVE-2024-11695](https://insights.sbomify.com/CVE-2024-11695/): Other in Firefox (medium 5.4)
- [CVE-2024-11694](https://insights.sbomify.com/CVE-2024-11694/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2024-11693](https://insights.sbomify.com/CVE-2024-11693/): Security feature bypass in Firefox (critical 9.8)
- [CVE-2024-11692](https://insights.sbomify.com/CVE-2024-11692/): Security feature bypass in Firefox (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/494/