# Vulnerabilities published in 2024


- [CVE-2024-11306](https://insights.sbomify.com/CVE-2024-11306/): Altenergy Power Control Software database improper authorization (medium 6.9)
- [CVE-2024-11305](https://insights.sbomify.com/CVE-2024-11305/): Altenergy Power Control Software status_zigbee get_status_zigbee sql injection (medium 5.3)
- [CVE-2024-11304](https://insights.sbomify.com/CVE-2024-11304/): Multiple Stored Cross-Site Scripting (medium 5.1)
- [CVE-2024-11303](https://insights.sbomify.com/CVE-2024-11303/): Path Traversal (high 8.7)
- [CVE-2024-11302](https://insights.sbomify.com/CVE-2024-11302/): Missing check_access in lollms_binding_infos in parisneo/lollms (high 8.0)
- [CVE-2024-11301](https://insights.sbomify.com/CVE-2024-11301/): Improper Enforcement of Unique Constraint in lunary-ai/lunary (medium 6.5)
- [CVE-2024-11300](https://insights.sbomify.com/CVE-2024-11300/): Improper Access Control in lunary-ai/lunary (high 8.8)
- [CVE-2024-1130](https://insights.sbomify.com/CVE-2024-1130/): NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() (medium 5.3)
- [CVE-2024-11299](https://insights.sbomify.com/CVE-2024-11299/): Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11297](https://insights.sbomify.com/CVE-2024-11297/): Information disclosure in Page and Post Restriction (medium 5.3)
- [CVE-2024-11295](https://insights.sbomify.com/CVE-2024-11295/): Simple Page Access Restriction <= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11294](https://insights.sbomify.com/CVE-2024-11294/): Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11293](https://insights.sbomify.com/CVE-2024-11293/): Auth bypass in Pie Register - Social Sites Login (Add on) (high 8.1)
- [CVE-2024-11292](https://insights.sbomify.com/CVE-2024-11292/): WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11291](https://insights.sbomify.com/CVE-2024-11291/): Information disclosure in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (medium 5.3)
- [CVE-2024-11290](https://insights.sbomify.com/CVE-2024-11290/): Member Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-1129](https://insights.sbomify.com/CVE-2024-1129/): NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() (medium 5.3)
- [CVE-2024-11289](https://insights.sbomify.com/CVE-2024-11289/): Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion (high 8.1)
- [CVE-2024-11287](https://insights.sbomify.com/CVE-2024-11287/): Ebook Store <= 5.8001 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11286](https://insights.sbomify.com/CVE-2024-11286/): WP JobHunt <= 7.1 - Authentication Bypass (critical 9.8)
- [CVE-2024-11285](https://insights.sbomify.com/CVE-2024-11285/): WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover (critical 9.8)
- [CVE-2024-11284](https://insights.sbomify.com/CVE-2024-11284/): WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover (critical 9.8)
- [CVE-2024-11283](https://insights.sbomify.com/CVE-2024-11283/): WP JobHunt <= 7.1 - Authentication Bypass to Candidate (high 7.5)
- [CVE-2024-11282](https://insights.sbomify.com/CVE-2024-11282/): Information disclosure in Passster – Password Protect Pages and Content (medium 5.3)
- [CVE-2024-11281](https://insights.sbomify.com/CVE-2024-11281/): Missing authorization in WooCommerce Point of Sale (critical 9.8)
- [CVE-2024-11280](https://insights.sbomify.com/CVE-2024-11280/): PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-1128](https://insights.sbomify.com/CVE-2024-1128/): Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A (medium 5.4)
- [CVE-2024-11279](https://insights.sbomify.com/CVE-2024-11279/): Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11278](https://insights.sbomify.com/CVE-2024-11278/): GD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11277](https://insights.sbomify.com/CVE-2024-11277/): 404 Solution <= 2.35.19 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11276](https://insights.sbomify.com/CVE-2024-11276/): PDF Builder for WooCommerce. Create invoices,packing slips and more <= 1.2.136 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11275](https://insights.sbomify.com/CVE-2024-11275/): Missing authorization in Timetics – Appointment Booking & Scheduling (medium 4.3)
- [CVE-2024-11274](https://insights.sbomify.com/CVE-2024-11274/): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (high 8.7)
- [CVE-2024-11273](https://insights.sbomify.com/CVE-2024-11273/): Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-11272](https://insights.sbomify.com/CVE-2024-11272/): Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-11271](https://insights.sbomify.com/CVE-2024-11271/): Missing authorization in WebinarPress – Webinar System for WordPress (high 8.8)
- [CVE-2024-11270](https://insights.sbomify.com/CVE-2024-11270/): Missing authorization in WebinarPress – Webinar System for WordPress (high 8.8)
- [CVE-2024-1127](https://insights.sbomify.com/CVE-2024-1127/): Missing authorization in EventPrime – Events Calendar, Bookings and Tickets (medium 4.3)
- [CVE-2024-11269](https://insights.sbomify.com/CVE-2024-11269/): AHAthat Plugin <= 1.6 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-11268](https://insights.sbomify.com/CVE-2024-11268/): PDF File Parsing Vulnerability in Autodesk Revit (medium 5.5)
- [CVE-2024-11267](https://insights.sbomify.com/CVE-2024-11267/): JSP Store Locator <= 1.0 - Contributor+ SQL Injection (high 8.8)
- [CVE-2024-11266](https://insights.sbomify.com/CVE-2024-11266/): Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11265](https://insights.sbomify.com/CVE-2024-11265/): Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure (medium 4.3)
- [CVE-2024-11263](https://insights.sbomify.com/CVE-2024-11263/): arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y (critical 9.4)
- [CVE-2024-11262](https://insights.sbomify.com/CVE-2024-11262/): SourceCodester Student Record Management System View All Student Marks main stack-based overflow (medium 4.8)
- [CVE-2024-11261](https://insights.sbomify.com/CVE-2024-11261/): Memory corruption in Student Record Management System (medium 4.8)
- [CVE-2024-11260](https://insights.sbomify.com/CVE-2024-11260/): SQL injection in Events Manager – Calendar, Bookings, Tickets, and more! (high 7.5)
- [CVE-2024-1126](https://insights.sbomify.com/CVE-2024-1126/): Missing authorization in EventPrime – Events Calendar, Bookings and Tickets (medium 4.3)
- [CVE-2024-11259](https://insights.sbomify.com/CVE-2024-11259/): code-projects Farmacia fornecedores.php cross site scripting (medium 5.3)
- [CVE-2024-11258](https://insights.sbomify.com/CVE-2024-11258/): 1000 Projects Beauty Parlour Management System index.php sql injection (medium 6.9)
- [CVE-2024-11257](https://insights.sbomify.com/CVE-2024-11257/): 1000 Projects Beauty Parlour Management System forgot-password.php sql injection (medium 6.9)
- [CVE-2024-11256](https://insights.sbomify.com/CVE-2024-11256/): 1000 Projects Portfolio Management System MCA login.php sql injection (medium 6.9)
- [CVE-2024-11254](https://insights.sbomify.com/CVE-2024-11254/): AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11253](https://insights.sbomify.com/CVE-2024-11253/): Command injection in VMG8825-T50K firmware (high 7.2)
- [CVE-2024-11252](https://insights.sbomify.com/CVE-2024-11252/): Cross-site scripting in Social Sharing Plugin – Sassy Social Share (medium 6.1)
- [CVE-2024-11251](https://insights.sbomify.com/CVE-2024-11251/): erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection (medium 5.3)
- [CVE-2024-11250](https://insights.sbomify.com/CVE-2024-11250/): code-projects Inventory Management editProduct.php sql injection (medium 5.3)
- [CVE-2024-1125](https://insights.sbomify.com/CVE-2024-1125/): Missing authorization in EventPrime – Events Calendar, Bookings and Tickets (medium 5.4)
- [CVE-2024-11248](https://insights.sbomify.com/CVE-2024-11248/): Tenda AC10 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow (high 8.7)
- [CVE-2024-11247](https://insights.sbomify.com/CVE-2024-11247/): SourceCodester Online Eyewear Shop Inventory Page Master.php cross site scripting (medium 5.3)
- [CVE-2024-11246](https://insights.sbomify.com/CVE-2024-11246/): code-projects Farmacia adicionar-cliente.php cross site scripting (medium 5.3)
- [CVE-2024-11245](https://insights.sbomify.com/CVE-2024-11245/): code-projects Farmacia editar-produto.php sql injection (medium 5.3)
- [CVE-2024-11244](https://insights.sbomify.com/CVE-2024-11244/): code-projects Farmacia editar-cliente.php sql injection (medium 5.3)
- [CVE-2024-11243](https://insights.sbomify.com/CVE-2024-11243/): code-projects Online Shop Store signup.php cross site scripting (medium 6.9)
- [CVE-2024-11242](https://insights.sbomify.com/CVE-2024-11242/): ZZCMS Keyword Filtering ad_list.php sql injection (medium 5.1)
- [CVE-2024-11241](https://insights.sbomify.com/CVE-2024-11241/): code-projects Job Recruitment reset.php sql injection (medium 6.9)
- [CVE-2024-11240](https://insights.sbomify.com/CVE-2024-11240/): IBPhoenix ibWebAdmin Banco de Dados Tab database.php cross site scripting (medium 5.3)
- [CVE-2024-1124](https://insights.sbomify.com/CVE-2024-1124/): Missing authorization in EventPrime – Events Calendar, Bookings and Tickets (medium 4.3)
- [CVE-2024-11239](https://insights.sbomify.com/CVE-2024-11239/): Landray EKP API Interface import.do deleteFile path traversal (medium 5.3)
- [CVE-2024-11238](https://insights.sbomify.com/CVE-2024-11238/): Landray EKP sysUiComponent.do delPreviewFile path traversal (medium 6.9)
- [CVE-2024-11237](https://insights.sbomify.com/CVE-2024-11237/): TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow (high 8.7)
- [CVE-2024-11236](https://insights.sbomify.com/CVE-2024-11236/): Integer overflow in the firebird and dblib quoters causing OOB writes (critical 9.8)
- [CVE-2024-11235](https://insights.sbomify.com/CVE-2024-11235/): Reference counting in php_request_shutdown causes Use-After-Free (critical 9.2)
- [CVE-2024-11234](https://insights.sbomify.com/CVE-2024-11234/): Configuring a proxy in a stream context might allow for CRLF injection in URIs (medium 4.8)
- [CVE-2024-11233](https://insights.sbomify.com/CVE-2024-11233/): Single byte overread with convert.quoted-printable-decode filter (medium 4.8)
- [CVE-2024-11231](https://insights.sbomify.com/CVE-2024-11231/): 우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode (medium 6.4)
- [CVE-2024-11230](https://insights.sbomify.com/CVE-2024-11230/): Cross-site scripting in Ultimate Addons for Elementor (medium 6.4)
- [CVE-2024-1123](https://insights.sbomify.com/CVE-2024-1123/): EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite (medium 6.5)
- [CVE-2024-11229](https://insights.sbomify.com/CVE-2024-11229/): Cross-site scripting in 코드엠샵 소셜톡 (medium 6.4)
- [CVE-2024-11228](https://insights.sbomify.com/CVE-2024-11228/): Cross-site scripting in 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 (medium 6.4)
- [CVE-2024-11227](https://insights.sbomify.com/CVE-2024-11227/): Cross-site scripting in Memberlite Shortcodes (medium 6.4)
- [CVE-2024-11226](https://insights.sbomify.com/CVE-2024-11226/): FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (medium 6.4)
- [CVE-2024-11225](https://insights.sbomify.com/CVE-2024-11225/): Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg (medium 6.1)
- [CVE-2024-11224](https://insights.sbomify.com/CVE-2024-11224/): Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter (medium 6.4)
- [CVE-2024-11223](https://insights.sbomify.com/CVE-2024-11223/): WPForms < 1.9.2.3 - Admin+ Stored XSS (medium 4.7)
- [CVE-2024-11222](https://insights.sbomify.com/CVE-2024-11222/): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (medium 6.4)
- [CVE-2024-11221](https://insights.sbomify.com/CVE-2024-11221/): Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11220](https://insights.sbomify.com/CVE-2024-11220/): Open Automation Software Incorrect Execution-Assigned Permissions (high 8.5)
- [CVE-2024-1122](https://insights.sbomify.com/CVE-2024-1122/): Missing authorization in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) (medium 5.3)
- [CVE-2024-11219](https://insights.sbomify.com/CVE-2024-11219/): Path traversal in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (medium 5.3)
- [CVE-2024-11218](https://insights.sbomify.com/CVE-2024-11218/): Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile (high 8.6)
- [CVE-2024-11217](https://insights.sbomify.com/CVE-2024-11217/): Oauth-server-container: oauth-server-container logs client secret in debug level (medium 4.9)
- [CVE-2024-11216](https://insights.sbomify.com/CVE-2024-11216/): Broken Access Control in PozitifIK's Pik Online (high 7.6)
- [CVE-2024-11215](https://insights.sbomify.com/CVE-2024-11215/): Path traversal vulnerability in EasyPHP (medium 6.5)
- [CVE-2024-11214](https://insights.sbomify.com/CVE-2024-11214/): SourceCodester Best Employee Management System profile.php unrestricted upload (medium 5.1)
- [CVE-2024-11213](https://insights.sbomify.com/CVE-2024-11213/): SourceCodester Best Employee Management System edit_role.php sql injection (medium 5.1)
- [CVE-2024-11212](https://insights.sbomify.com/CVE-2024-11212/): SourceCodester Best Employee Management System fetch_product_details.php sql injection (medium 5.3)
- [CVE-2024-11211](https://insights.sbomify.com/CVE-2024-11211/): EyouCMS Website Logo unrestricted upload (medium 5.1)
- [CVE-2024-11210](https://insights.sbomify.com/CVE-2024-11210/): EyouCMS FilemanagerLogic.php editFile path traversal (medium 5.3)
- [CVE-2024-1121](https://insights.sbomify.com/CVE-2024-1121/): Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/499/