# Vulnerabilities published in 2024


- [CVE-2024-10907](https://insights.sbomify.com/CVE-2024-10907/): Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat (high 7.5)
- [CVE-2024-10906](https://insights.sbomify.com/CVE-2024-10906/): Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt (high 7.1)
- [CVE-2024-10905](https://insights.sbomify.com/CVE-2024-10905/): IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability (critical 10.0)
- [CVE-2024-10904](https://insights.sbomify.com/CVE-2024-10904/): Stored XSS in Server Admin API (medium 4.8)
- [CVE-2024-10903](https://insights.sbomify.com/CVE-2024-10903/): Broken Link Checker < 2.4.2 - Admin+ SSRF (medium 4.7)
- [CVE-2024-10902](https://insights.sbomify.com/CVE-2024-10902/): Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt (critical 9.1)
- [CVE-2024-10901](https://insights.sbomify.com/CVE-2024-10901/): Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt (critical 9.1)
- [CVE-2024-10900](https://insights.sbomify.com/CVE-2024-10900/): Missing authorization in ProfileGrid – User Profiles, Groups and Communities (medium 6.5)
- [CVE-2024-1090](https://insights.sbomify.com/CVE-2024-1090/): ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAll (medium 4.3)
- [CVE-2024-10899](https://insights.sbomify.com/CVE-2024-10899/): Code injection in Product Table and List Builder for WooCommerce Lite (high 7.3)
- [CVE-2024-10898](https://insights.sbomify.com/CVE-2024-10898/): Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-10897](https://insights.sbomify.com/CVE-2024-10897/): Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation (medium 4.3)
- [CVE-2024-10896](https://insights.sbomify.com/CVE-2024-10896/): Logo Slider < 4.5.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-10895](https://insights.sbomify.com/CVE-2024-10895/): Cross-site scripting in Counter Up – Animated Number Counter & Milestone Showcase (medium 6.4)
- [CVE-2024-10894](https://insights.sbomify.com/CVE-2024-10894/): Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10893](https://insights.sbomify.com/CVE-2024-10893/): WP Booking Calendar < 10.6.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10892](https://insights.sbomify.com/CVE-2024-10892/): Cost Calculator Builder < 3.2.43 - Settings update via CSRF (medium 5.4)
- [CVE-2024-10891](https://insights.sbomify.com/CVE-2024-10891/): Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10890](https://insights.sbomify.com/CVE-2024-10890/): WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1089](https://insights.sbomify.com/CVE-2024-1089/): ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOn (medium 4.3)
- [CVE-2024-10887](https://insights.sbomify.com/CVE-2024-10887/): NiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10886](https://insights.sbomify.com/CVE-2024-10886/): Cross-site scripting in Tribute Testimonials – WordPress Testimonial Grid/Slider (medium 6.4)
- [CVE-2024-10885](https://insights.sbomify.com/CVE-2024-10885/): SearchIQ – The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10884](https://insights.sbomify.com/CVE-2024-10884/): SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10883](https://insights.sbomify.com/CVE-2024-10883/): SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10882](https://insights.sbomify.com/CVE-2024-10882/): Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10881](https://insights.sbomify.com/CVE-2024-10881/): LUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-10880](https://insights.sbomify.com/CVE-2024-10880/): JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1088](https://insights.sbomify.com/CVE-2024-1088/): Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API (medium 5.3)
- [CVE-2024-10879](https://insights.sbomify.com/CVE-2024-10879/): ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10878](https://insights.sbomify.com/CVE-2024-10878/): Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10877](https://insights.sbomify.com/CVE-2024-10877/): AFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10876](https://insights.sbomify.com/CVE-2024-10876/): Cross-site scripting in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (medium 6.1)
- [CVE-2024-10875](https://insights.sbomify.com/CVE-2024-10875/): Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10874](https://insights.sbomify.com/CVE-2024-10874/): Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10873](https://insights.sbomify.com/CVE-2024-10873/): LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-10872](https://insights.sbomify.com/CVE-2024-10872/): Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10871](https://insights.sbomify.com/CVE-2024-10871/): Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-10869](https://insights.sbomify.com/CVE-2024-10869/): GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10868](https://insights.sbomify.com/CVE-2024-10868/): Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10867](https://insights.sbomify.com/CVE-2024-10867/): Cross-site scripting in Borderless – Addons and Templates for Elementor (medium 5.4)
- [CVE-2024-10866](https://insights.sbomify.com/CVE-2024-10866/): Export Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Export (medium 5.3)
- [CVE-2024-10865](https://insights.sbomify.com/CVE-2024-10865/): Reflected Cross-Site Scripting vulnerability in OpenText Advanced Authentication (critical 9.4)
- [CVE-2024-10864](https://insights.sbomify.com/CVE-2024-10864/): SQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication. (high 7.5)
- [CVE-2024-10863](https://insights.sbomify.com/CVE-2024-10863/): Client-side audit exclusion vulnerability (medium 5.1)
- [CVE-2024-10862](https://insights.sbomify.com/CVE-2024-10862/): NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2024-10861](https://insights.sbomify.com/CVE-2024-10861/): Missing authorization in Popup Box – Create Countdown, Coupon, Video, Contact Form Popups (medium 5.3)
- [CVE-2024-10860](https://insights.sbomify.com/CVE-2024-10860/): Missing authorization in NextMove Lite – Thank You Page for WooCommerce (medium 4.3)
- [CVE-2024-1086](https://insights.sbomify.com/CVE-2024-1086/): Linux Kernel Use-After-Free (high 7.8, exploited in the wild)
- [CVE-2024-10858](https://insights.sbomify.com/CVE-2024-10858/): Jetpack 13.0-14.0 - Unauthenticated DOM-XSS (medium 6.1)
- [CVE-2024-10857](https://insights.sbomify.com/CVE-2024-10857/): Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read (medium 6.5)
- [CVE-2024-10856](https://insights.sbomify.com/CVE-2024-10856/): Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-10855](https://insights.sbomify.com/CVE-2024-10855/): Missing authorization in Image Optimizer, Resizer and CDN – Sirv (high 8.1)
- [CVE-2024-10854](https://insights.sbomify.com/CVE-2024-10854/): Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import (medium 4.3)
- [CVE-2024-10853](https://insights.sbomify.com/CVE-2024-10853/): Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion (medium 4.3)
- [CVE-2024-10852](https://insights.sbomify.com/CVE-2024-10852/): Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export (medium 4.3)
- [CVE-2024-10851](https://insights.sbomify.com/CVE-2024-10851/): Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10850](https://insights.sbomify.com/CVE-2024-10850/): Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1085](https://insights.sbomify.com/CVE-2024-1085/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2024-10849](https://insights.sbomify.com/CVE-2024-10849/): NewsMash <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10848](https://insights.sbomify.com/CVE-2024-10848/): NewsMunch <= 1.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10847](https://insights.sbomify.com/CVE-2024-10847/): Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10846](https://insights.sbomify.com/CVE-2024-10846/): Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop (medium 5.9)
- [CVE-2024-10845](https://insights.sbomify.com/CVE-2024-10845/): 1000 Projects Bookstore Management System book_detail.php sql injection (medium 6.9)
- [CVE-2024-10844](https://insights.sbomify.com/CVE-2024-10844/): 1000 Projects Bookstore Management System search.php sql injection (medium 6.9)
- [CVE-2024-10842](https://insights.sbomify.com/CVE-2024-10842/): romadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scripting (medium 5.1)
- [CVE-2024-10841](https://insights.sbomify.com/CVE-2024-10841/): romadebrian WEB-Sekolah Mail Proses_Kirim.php sql injection (medium 5.3)
- [CVE-2024-10840](https://insights.sbomify.com/CVE-2024-10840/): romadebrian WEB-Sekolah Backend akun_edit.php cross site scripting (medium 5.1)
- [CVE-2024-1084](https://insights.sbomify.com/CVE-2024-1084/): Cross-site scripting in Enterprise Server (medium 6.5)
- [CVE-2024-10839](https://insights.sbomify.com/CVE-2024-10839/): XML External Entity (high 8.5)
- [CVE-2024-10838](https://insights.sbomify.com/CVE-2024-10838/): Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read (high 8.8)
- [CVE-2024-10837](https://insights.sbomify.com/CVE-2024-10837/): SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter (medium 6.1)
- [CVE-2024-10836](https://insights.sbomify.com/CVE-2024-10836/): Flixita <= 1.0.82 - Reflected Cross-Site Scripting via id Parameter (medium 6.1)
- [CVE-2024-10835](https://insights.sbomify.com/CVE-2024-10835/): Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt (critical 9.1)
- [CVE-2024-10834](https://insights.sbomify.com/CVE-2024-10834/): Arbitrary File Write in eosphoros-ai/db-gpt (critical 9.1)
- [CVE-2024-10833](https://insights.sbomify.com/CVE-2024-10833/): Arbitrary File Write in eosphoros-ai/db-gpt (critical 9.1)
- [CVE-2024-10832](https://insights.sbomify.com/CVE-2024-10832/): Posti Shipping <= 3.10.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10831](https://insights.sbomify.com/CVE-2024-10831/): Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt (critical 9.1)
- [CVE-2024-10830](https://insights.sbomify.com/CVE-2024-10830/): Path Traversal in eosphoros-ai/db-gpt (high 8.2)
- [CVE-2024-1083](https://insights.sbomify.com/CVE-2024-1083/): Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-10829](https://insights.sbomify.com/CVE-2024-10829/): Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt (high 7.5)
- [CVE-2024-10828](https://insights.sbomify.com/CVE-2024-10828/): Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details (high 8.1)
- [CVE-2024-10827](https://insights.sbomify.com/CVE-2024-10827/): Use after free in Chrome (high 8.8)
- [CVE-2024-10826](https://insights.sbomify.com/CVE-2024-10826/): Use after free in Chrome (high 8.8)
- [CVE-2024-10825](https://insights.sbomify.com/CVE-2024-10825/): Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL (medium 6.1)
- [CVE-2024-10824](https://insights.sbomify.com/CVE-2024-10824/): Missing authorization in Enterprise Server (medium 6.0)
- [CVE-2024-10821](https://insights.sbomify.com/CVE-2024-10821/): Denial of Service (DoS) in invoke-ai/invokeai (high 7.5)
- [CVE-2024-10820](https://insights.sbomify.com/CVE-2024-10820/): WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-1082](https://insights.sbomify.com/CVE-2024-1082/): Path traversal in Enterprise Server (medium 6.3)
- [CVE-2024-10819](https://insights.sbomify.com/CVE-2024-10819/): CSRF to XSS in binary-husky/gpt_academic (high 7.1)
- [CVE-2024-10818](https://insights.sbomify.com/CVE-2024-10818/): JSFiddle Shortcode < 1.1.3 - Contributor+ XSS via Shortcode (medium 5.4)
- [CVE-2024-10816](https://insights.sbomify.com/CVE-2024-10816/): LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read (high 7.5)
- [CVE-2024-10815](https://insights.sbomify.com/CVE-2024-10815/): PostLists <= 2.0.2 - Reflected XSS (medium 4.2)
- [CVE-2024-10814](https://insights.sbomify.com/CVE-2024-10814/): Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery (medium 6.4)
- [CVE-2024-10813](https://insights.sbomify.com/CVE-2024-10813/): Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure (medium 5.3)
- [CVE-2024-10812](https://insights.sbomify.com/CVE-2024-10812/): Open Redirect in binary-husky/gpt_academic (medium 6.1)
- [CVE-2024-10811](https://insights.sbomify.com/CVE-2024-10811/): Path traversal in Endpoint Manager (critical 9.8)
- [CVE-2024-10810](https://insights.sbomify.com/CVE-2024-10810/): code-projects E-Health Care System app_request.php sql injection (medium 5.3)
- [CVE-2024-1081](https://insights.sbomify.com/CVE-2024-1081/): 3D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks (medium 6.4)
- [CVE-2024-10809](https://insights.sbomify.com/CVE-2024-10809/): code-projects E-Health Care System chat.php sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/503/