# Vulnerabilities published in 2024


- [CVE-2024-11109](https://insights.sbomify.com/CVE-2024-11109/): WP Google Review Slider < 15.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11108](https://insights.sbomify.com/CVE-2024-11108/): Serious Slider < 1.2.7 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2024-11107](https://insights.sbomify.com/CVE-2024-11107/): System Dashboard < 2.8.15 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-11106](https://insights.sbomify.com/CVE-2024-11106/): Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11104](https://insights.sbomify.com/CVE-2024-11104/): Missing authorization in Sky Addons – Elementor Addons with Widgets & Templates (high 8.1)
- [CVE-2024-11103](https://insights.sbomify.com/CVE-2024-11103/): Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover (critical 9.8)
- [CVE-2024-11102](https://insights.sbomify.com/CVE-2024-11102/): SourceCodester Hospital Management System edit-doc.php cross site scripting (medium 5.3)
- [CVE-2024-11101](https://insights.sbomify.com/CVE-2024-11101/): 1000 Projects Beauty Parlour Management System search-invoices.php sql injection (medium 5.1)
- [CVE-2024-11100](https://insights.sbomify.com/CVE-2024-11100/): 1000 Projects Beauty Parlour Management System index.php sql injection (medium 6.9)
- [CVE-2024-1110](https://insights.sbomify.com/CVE-2024-1110/): Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import (medium 5.3)
- [CVE-2024-11099](https://insights.sbomify.com/CVE-2024-11099/): code-projects Job Recruitment login.php sql injection (medium 6.9)
- [CVE-2024-11098](https://insights.sbomify.com/CVE-2024-11098/): SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (medium 5.5)
- [CVE-2024-11097](https://insights.sbomify.com/CVE-2024-11097/): SourceCodester Student Record Management System Main Menu infinite loop (medium 4.8)
- [CVE-2024-11096](https://insights.sbomify.com/CVE-2024-11096/): code-projects Task Manager newProject.php sql injection (medium 5.3)
- [CVE-2024-11095](https://insights.sbomify.com/CVE-2024-11095/): Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-11094](https://insights.sbomify.com/CVE-2024-11094/): 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11093](https://insights.sbomify.com/CVE-2024-11093/): SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (medium 5.5)
- [CVE-2024-11092](https://insights.sbomify.com/CVE-2024-11092/): SVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-11091](https://insights.sbomify.com/CVE-2024-11091/): Cross-site scripting in Support SVG – Upload svg files in wordpress without hassle (medium 6.4)
- [CVE-2024-11090](https://insights.sbomify.com/CVE-2024-11090/): Information disclosure in Membership Plugin – Restrict Content (medium 5.3)
- [CVE-2024-1109](https://insights.sbomify.com/CVE-2024-1109/): Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export (medium 5.3)
- [CVE-2024-11089](https://insights.sbomify.com/CVE-2024-11089/): Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11088](https://insights.sbomify.com/CVE-2024-11088/): Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor (medium 5.3)
- [CVE-2024-11087](https://insights.sbomify.com/CVE-2024-11087/): miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass (high 8.1)
- [CVE-2024-11085](https://insights.sbomify.com/CVE-2024-11085/): WP Log Viewer <= 1.2.1 - Missing Authorization (medium 5.4)
- [CVE-2024-11084](https://insights.sbomify.com/CVE-2024-11084/): Potential Username Enumeration in Helix ALM (medium 6.3)
- [CVE-2024-11083](https://insights.sbomify.com/CVE-2024-11083/): ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11082](https://insights.sbomify.com/CVE-2024-11082/): Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function (critical 9.9)
- [CVE-2024-11080](https://insights.sbomify.com/CVE-2024-11080/): Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection (critical 9.8)
- [CVE-2024-1108](https://insights.sbomify.com/CVE-2024-1108/): Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service (medium 6.5)
- [CVE-2024-11079](https://insights.sbomify.com/CVE-2024-11079/): Ansible-core: unsafe tagging bypass via hostvars object in ansible-core (medium 5.5)
- [CVE-2024-11078](https://insights.sbomify.com/CVE-2024-11078/): code-projects Job Recruitment register.php cross site scripting (medium 5.3)
- [CVE-2024-11077](https://insights.sbomify.com/CVE-2024-11077/): code-projects Job Recruitment index.php sql injection (medium 6.9)
- [CVE-2024-11076](https://insights.sbomify.com/CVE-2024-11076/): code-projects Job Recruitment activation.php sql injection (medium 5.3)
- [CVE-2024-11075](https://insights.sbomify.com/CVE-2024-11075/): SICK Incoming Goods Suite privilege escalation vulnerability (high 8.8)
- [CVE-2024-11074](https://insights.sbomify.com/CVE-2024-11074/): itsourcecode Tailoring Management System incadd.php sql injection (medium 5.3)
- [CVE-2024-11073](https://insights.sbomify.com/CVE-2024-11073/): SourceCodester Hospital Management System delete-account.php improper authorization (medium 5.3)
- [CVE-2024-11071](https://insights.sbomify.com/CVE-2024-11071/): Improper Access Control In DestinyECM (high 7.7)
- [CVE-2024-11070](https://insights.sbomify.com/CVE-2024-11070/): Sanluan PublicCMS Tag Type save cross site scripting (medium 5.3)
- [CVE-2024-1107](https://insights.sbomify.com/CVE-2024-1107/): IDOR in Talya Informatics' Travel APPS (critical 9.8)
- [CVE-2024-11069](https://insights.sbomify.com/CVE-2024-11069/): WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion (medium 6.5)
- [CVE-2024-11068](https://insights.sbomify.com/CVE-2024-11068/): D-Link DSL6740C - Incorrect Use of Privileged APIs (critical 9.8)
- [CVE-2024-11067](https://insights.sbomify.com/CVE-2024-11067/): D-Link DSL6740C - Arbitrary File Reading through Path Traversal (high 7.5)
- [CVE-2024-11066](https://insights.sbomify.com/CVE-2024-11066/): D-Link DSL6740C - OS Command Injection (high 7.2)
- [CVE-2024-11065](https://insights.sbomify.com/CVE-2024-11065/): D-Link DSL6740C - OS Command Injection (high 7.2)
- [CVE-2024-11064](https://insights.sbomify.com/CVE-2024-11064/): D-Link DSL6740C - OS Command Injection (high 7.2)
- [CVE-2024-11063](https://insights.sbomify.com/CVE-2024-11063/): D-Link DSL6740C - OS Command Injection (high 7.2)
- [CVE-2024-11062](https://insights.sbomify.com/CVE-2024-11062/): D-Link DSL6740C - OS Command Injection (high 7.2)
- [CVE-2024-11061](https://insights.sbomify.com/CVE-2024-11061/): Tenda AC10 fast_setting_wifi_set FUN_0044db3c stack-based overflow (high 8.7)
- [CVE-2024-11060](https://insights.sbomify.com/CVE-2024-11060/): Jinher Network Collaborative Management Platform 金和数字化智能办公平台 AcceptShow.aspx sql injection (medium 5.3)
- [CVE-2024-1106](https://insights.sbomify.com/CVE-2024-1106/): Shariff Wrapper < 4.6.10 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-11059](https://insights.sbomify.com/CVE-2024-11059/): Project Worlds Free Download Online Shopping System success.php sql injection (medium 5.3)
- [CVE-2024-11058](https://insights.sbomify.com/CVE-2024-11058/): CodeAstro Real Estate Management System About Us Page aboutedit.php sql injection (medium 5.1)
- [CVE-2024-11057](https://insights.sbomify.com/CVE-2024-11057/): Codezips Hospital Appointment System removeBranchResult.php sql injection (medium 6.9)
- [CVE-2024-11056](https://insights.sbomify.com/CVE-2024-11056/): Tenda AC10 WifiExtraSet FUN_0046AC38 stack-based overflow (high 8.7)
- [CVE-2024-11055](https://insights.sbomify.com/CVE-2024-11055/): 1000 Projects Beauty Parlour Management System admin-profile.php sql injection (medium 6.9)
- [CVE-2024-11054](https://insights.sbomify.com/CVE-2024-11054/): SourceCodester Simple Music Cloud Community System ajax.php unrestricted upload (medium 5.3)
- [CVE-2024-11053](https://insights.sbomify.com/CVE-2024-11053/): netrc and redirect credential leak (low 3.4)
- [CVE-2024-11052](https://insights.sbomify.com/CVE-2024-11052/): Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You (high 7.2)
- [CVE-2024-11051](https://insights.sbomify.com/CVE-2024-11051/): AMTT Hotel Broadband Operation System online_status.php sql injection (medium 5.3)
- [CVE-2024-11050](https://insights.sbomify.com/CVE-2024-11050/): AMTT Hotel Broadband Operation System language.php cross site scripting (medium 5.3)
- [CVE-2024-11049](https://insights.sbomify.com/CVE-2024-11049/): ZKTeco ZKBio Time Image File photo direct request (medium 6.3)
- [CVE-2024-11048](https://insights.sbomify.com/CVE-2024-11048/): D-Link DI-8003 dbsrv.asp dbsrv_asp stack-based overflow (high 8.7)
- [CVE-2024-11047](https://insights.sbomify.com/CVE-2024-11047/): D-Link DI-8003 upgrade_filter.asp upgrade_filter_asp stack-based overflow (high 8.7)
- [CVE-2024-11046](https://insights.sbomify.com/CVE-2024-11046/): D-Link DI-8003 upgrade_filter.asp upgrade_filter_asp os command injection (medium 5.3)
- [CVE-2024-11045](https://insights.sbomify.com/CVE-2024-11045/): Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui (critical 9.6)
- [CVE-2024-11044](https://insights.sbomify.com/CVE-2024-11044/): Open Redirect in automatic1111/stable-diffusion-webui (medium 6.1)
- [CVE-2024-11043](https://insights.sbomify.com/CVE-2024-11043/): Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai (high 7.5)
- [CVE-2024-11042](https://insights.sbomify.com/CVE-2024-11042/): Arbitrary File Delete in invoke-ai/invokeai (critical 9.1)
- [CVE-2024-11041](https://insights.sbomify.com/CVE-2024-11041/): Remote Code Execution in vllm-project/vllm (critical 9.8)
- [CVE-2024-1104](https://insights.sbomify.com/CVE-2024-1104/): Temporary denial of service during a brute force attack (high 7.5)
- [CVE-2024-11039](https://insights.sbomify.com/CVE-2024-11039/): Deserialization of Untrusted Data in binary-husky/gpt_academic (high 8.8)
- [CVE-2024-11038](https://insights.sbomify.com/CVE-2024-11038/): Code injection in WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click (high 7.3)
- [CVE-2024-11037](https://insights.sbomify.com/CVE-2024-11037/): Path Traversal in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-11036](https://insights.sbomify.com/CVE-2024-11036/): Code injection in GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress (high 7.3)
- [CVE-2024-11035](https://insights.sbomify.com/CVE-2024-11035/): Carbon Black Cloud Windows Sensor Information Leak (low 2.5)
- [CVE-2024-11034](https://insights.sbomify.com/CVE-2024-11034/): Code injection in Request a Quote for WooCommerce – Get a Quote Button (high 7.3)
- [CVE-2024-11033](https://insights.sbomify.com/CVE-2024-11033/): Denial of Service (DoS) in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-11032](https://insights.sbomify.com/CVE-2024-11032/): Parsi Date <= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-11031](https://insights.sbomify.com/CVE-2024-11031/): SSRF in binary-husky/gpt_academic (high 7.7)
- [CVE-2024-11030](https://insights.sbomify.com/CVE-2024-11030/): SSRF in binary-husky/gpt_academic (high 7.7)
- [CVE-2024-1103](https://insights.sbomify.com/CVE-2024-1103/): CodeAstro Real Estate Management System Feedback Form profile.php cross site scripting (low 3.5)
- [CVE-2024-11029](https://insights.sbomify.com/CVE-2024-11029/): Freeipa: administrative user data leaked through systemd journal (medium 5.5)
- [CVE-2024-11028](https://insights.sbomify.com/CVE-2024-11028/): MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation (critical 9.8)
- [CVE-2024-11026](https://insights.sbomify.com/CVE-2024-11026/): Intelligent Apps Freenow App Keystore SSL.java hard-coded password (medium 6.3)
- [CVE-2024-11025](https://insights.sbomify.com/CVE-2024-11025/): SMA: SQL injection in Sunny Central UP (medium 5.4)
- [CVE-2024-11024](https://insights.sbomify.com/CVE-2024-11024/): AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset (critical 9.8)
- [CVE-2024-11023](https://insights.sbomify.com/CVE-2024-11023/): Session Hijacking in Firebase JavaScript SDK (medium 5.2)
- [CVE-2024-11022](https://insights.sbomify.com/CVE-2024-11022/): SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack (medium 5.6)
- [CVE-2024-11021](https://insights.sbomify.com/CVE-2024-11021/): Grand Vice info Webopac - Stored XSS (medium 5.4)
- [CVE-2024-11020](https://insights.sbomify.com/CVE-2024-11020/): Grand Vice info Webopac7 - SQL Injection (critical 9.8)
- [CVE-2024-1102](https://insights.sbomify.com/CVE-2024-1102/): Jberet: jberet-core logging database credentials (medium 6.5)
- [CVE-2024-11019](https://insights.sbomify.com/CVE-2024-11019/): Grand Vice info Webopac7 - Reflected XSS (medium 6.1)
- [CVE-2024-11018](https://insights.sbomify.com/CVE-2024-11018/): Grand Vice info Webopac - Arbitrary File Upload (critical 9.8)
- [CVE-2024-11017](https://insights.sbomify.com/CVE-2024-11017/): Grand Vice info Webopac - Arbitrary File Upload (high 8.8)
- [CVE-2024-11016](https://insights.sbomify.com/CVE-2024-11016/): Grand Vice info Webopac - SQL Injection (critical 9.8)
- [CVE-2024-11015](https://insights.sbomify.com/CVE-2024-11015/): Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user (critical 9.8)
- [CVE-2024-11014](https://insights.sbomify.com/CVE-2024-11014/): Cross-site request forgery in UNIVERGE IX (medium 4.3)
- [CVE-2024-11013](https://insights.sbomify.com/CVE-2024-11013/): Command injection in UNIVERGE IX (high 7.2)
- [CVE-2024-11012](https://insights.sbomify.com/CVE-2024-11012/): Code injection in Notibar – Notification Bar for WordPress (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/501/