# Vulnerabilities published in 2024


- [CVE-2024-10808](https://insights.sbomify.com/CVE-2024-10808/): code-projects E-Health Care System req_detail.php sql injection (medium 5.3)
- [CVE-2024-10807](https://insights.sbomify.com/CVE-2024-10807/): PHPGurukul Hospital Management System search.php cross site scripting (medium 5.1)
- [CVE-2024-10806](https://insights.sbomify.com/CVE-2024-10806/): PHPGurukul Hospital Management System betweendates-detailsreports.php cross site scripting (medium 5.1)
- [CVE-2024-10805](https://insights.sbomify.com/CVE-2024-10805/): code-projects University Event Management System doedit.php sql injection (medium 5.3)
- [CVE-2024-10804](https://insights.sbomify.com/CVE-2024-10804/): Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download (high 7.5)
- [CVE-2024-10803](https://insights.sbomify.com/CVE-2024-10803/): MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download (high 7.5)
- [CVE-2024-10802](https://insights.sbomify.com/CVE-2024-10802/): Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure (medium 5.3)
- [CVE-2024-10801](https://insights.sbomify.com/CVE-2024-10801/): WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-10800](https://insights.sbomify.com/CVE-2024-10800/): WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2024-1080](https://insights.sbomify.com/CVE-2024-1080/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2024-10799](https://insights.sbomify.com/CVE-2024-10799/): Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read (medium 6.5)
- [CVE-2024-10798](https://insights.sbomify.com/CVE-2024-10798/): Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10797](https://insights.sbomify.com/CVE-2024-10797/): Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10796](https://insights.sbomify.com/CVE-2024-10796/): If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10795](https://insights.sbomify.com/CVE-2024-10795/): Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10794](https://insights.sbomify.com/CVE-2024-10794/): Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10793](https://insights.sbomify.com/CVE-2024-10793/): WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter (high 7.2)
- [CVE-2024-10792](https://insights.sbomify.com/CVE-2024-10792/): Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10791](https://insights.sbomify.com/CVE-2024-10791/): Codezips Hospital Appointment System doctorAction.php sql injection (medium 6.9)
- [CVE-2024-10790](https://insights.sbomify.com/CVE-2024-10790/): Admin and Site Enhancements (ASE) <= 7.5.1 - Authenticated Stored Cross-Site Scripting via SVG (medium 5.4)
- [CVE-2024-1079](https://insights.sbomify.com/CVE-2024-1079/): Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval (medium 5.3)
- [CVE-2024-10789](https://insights.sbomify.com/CVE-2024-10789/): WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2024-10788](https://insights.sbomify.com/CVE-2024-10788/): Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context (high 7.2)
- [CVE-2024-10787](https://insights.sbomify.com/CVE-2024-10787/): LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10786](https://insights.sbomify.com/CVE-2024-10786/): Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing (medium 4.3)
- [CVE-2024-10785](https://insights.sbomify.com/CVE-2024-10785/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-10784](https://insights.sbomify.com/CVE-2024-10784/): Cross-site scripting in Unlimited Elements For Elementor (medium 6.4)
- [CVE-2024-10783](https://insights.sbomify.com/CVE-2024-10783/): MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation (high 8.1)
- [CVE-2024-10782](https://insights.sbomify.com/CVE-2024-10782/): Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10781](https://insights.sbomify.com/CVE-2024-10781/): Missing authorization in Spam protection, Honeypot, Anti-Spam by CleanTalk (high 8.1)
- [CVE-2024-10780](https://insights.sbomify.com/CVE-2024-10780/): Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-1078](https://insights.sbomify.com/CVE-2024-1078/): Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification (medium 4.3)
- [CVE-2024-10779](https://insights.sbomify.com/CVE-2024-10779/): Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure (medium 5.3)
- [CVE-2024-10778](https://insights.sbomify.com/CVE-2024-10778/): BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10777](https://insights.sbomify.com/CVE-2024-10777/): AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10776](https://insights.sbomify.com/CVE-2024-10776/): SICK InspectorP61x and SICK InspectorP62x: missing authentication (high 8.2)
- [CVE-2024-10775](https://insights.sbomify.com/CVE-2024-10775/): Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10774](https://insights.sbomify.com/CVE-2024-10774/): SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs (high 7.3)
- [CVE-2024-10773](https://insights.sbomify.com/CVE-2024-10773/): SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks (critical 9.0)
- [CVE-2024-10772](https://insights.sbomify.com/CVE-2024-10772/): SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification (high 8.8)
- [CVE-2024-10771](https://insights.sbomify.com/CVE-2024-10771/): SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution (high 8.8)
- [CVE-2024-10770](https://insights.sbomify.com/CVE-2024-10770/): Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-1077](https://insights.sbomify.com/CVE-2024-1077/): Use after free in Chrome (high 8.8)
- [CVE-2024-10768](https://insights.sbomify.com/CVE-2024-10768/): PHPGurukul Online Shopping Portal two_tables.php cross site scripting (medium 5.3)
- [CVE-2024-10766](https://insights.sbomify.com/CVE-2024-10766/): Codezips Free Exam Hall Seating Management System save_user.php unrestricted upload (medium 5.3)
- [CVE-2024-10765](https://insights.sbomify.com/CVE-2024-10765/): Codezips Online Institute Management System profile.php unrestricted upload (medium 5.3)
- [CVE-2024-10764](https://insights.sbomify.com/CVE-2024-10764/): Codezips Online Institute Management System save_user.php unrestricted upload (medium 5.3)
- [CVE-2024-10763](https://insights.sbomify.com/CVE-2024-10763/): Campress <= 1.35 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-10762](https://insights.sbomify.com/CVE-2024-10762/): Missing Authorization in lunary-ai/lunary (high 8.1)
- [CVE-2024-10761](https://insights.sbomify.com/CVE-2024-10761/): Umbraco CMS Dashboard frame cross site scripting (medium 6.9)
- [CVE-2024-10760](https://insights.sbomify.com/CVE-2024-10760/): code-projects University Event Management System dodelete.php sql injection (medium 5.3)
- [CVE-2024-1076](https://insights.sbomify.com/CVE-2024-1076/): SSL Zen <= 4.5.3 - Unauthenticated Private Keys Access (medium 6.5)
- [CVE-2024-10759](https://insights.sbomify.com/CVE-2024-10759/): itsourcecode Farm Management System edit-pig.php sql injection (medium 5.3)
- [CVE-2024-10758](https://insights.sbomify.com/CVE-2024-10758/): code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection (medium 6.9)
- [CVE-2024-10757](https://insights.sbomify.com/CVE-2024-10757/): PHPGurukul Online Shopping Portal js_data.php cross site scripting (medium 5.3)
- [CVE-2024-10756](https://insights.sbomify.com/CVE-2024-10756/): PHPGurukul Online Shopping Portal html_table.php cross site scripting (medium 5.3)
- [CVE-2024-10755](https://insights.sbomify.com/CVE-2024-10755/): PHPGurukul Online Shopping Portal empty_table.php cross site scripting (medium 5.3)
- [CVE-2024-10754](https://insights.sbomify.com/CVE-2024-10754/): PHPGurukul Online Shopping Portal dymanic_table.php cross site scripting (medium 5.3)
- [CVE-2024-10753](https://insights.sbomify.com/CVE-2024-10753/): PHPGurukul Online Shopping Portal dom_data_two_headers.php cross site scripting (medium 5.3)
- [CVE-2024-10752](https://insights.sbomify.com/CVE-2024-10752/): Codezips Pet Shop Management System productsadd.php sql injection (medium 6.9)
- [CVE-2024-10751](https://insights.sbomify.com/CVE-2024-10751/): Codezips ISP Management System pay.php sql injection (medium 5.3)
- [CVE-2024-10750](https://insights.sbomify.com/CVE-2024-10750/): Tenda i22 SysToo websReadEvent null pointer dereference (high 7.1)
- [CVE-2024-1075](https://insights.sbomify.com/CVE-2024-1075/): Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass (low 3.7)
- [CVE-2024-10749](https://insights.sbomify.com/CVE-2024-10749/): ThinkAdmin Plugs.php script deserialization (low 2.3)
- [CVE-2024-10748](https://insights.sbomify.com/CVE-2024-10748/): Cosmote Greece What's Up App Realm Database RealmDB.java default key (low 2.0)
- [CVE-2024-10747](https://insights.sbomify.com/CVE-2024-10747/): PHPGurukul Online Shopping Portal dom_data_th.php cross site scripting (medium 5.3)
- [CVE-2024-10746](https://insights.sbomify.com/CVE-2024-10746/): PHPGurukul Online Shopping Portal dom_data.php cross site scripting (medium 5.3)
- [CVE-2024-10745](https://insights.sbomify.com/CVE-2024-10745/): PHPGurukul Online Shopping Portal deferred_table.php cross site scripting (medium 5.3)
- [CVE-2024-10744](https://insights.sbomify.com/CVE-2024-10744/): PHPGurukul Online Shopping Portal complex_header_2.php cross site scripting (medium 5.3)
- [CVE-2024-10743](https://insights.sbomify.com/CVE-2024-10743/): PHPGurukul Online Shopping Portal editable_ajax.php cross site scripting (medium 5.3)
- [CVE-2024-10742](https://insights.sbomify.com/CVE-2024-10742/): code-projects Wazifa System control.php sql injection (medium 5.3)
- [CVE-2024-10741](https://insights.sbomify.com/CVE-2024-10741/): code-projects E-Health Care System registration.php sql injection (medium 6.9)
- [CVE-2024-10740](https://insights.sbomify.com/CVE-2024-10740/): code-projects E-Health Care System consulting_detail.php sql injection (medium 5.3)
- [CVE-2024-1074](https://insights.sbomify.com/CVE-2024-1074/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2024-10739](https://insights.sbomify.com/CVE-2024-10739/): code-projects E-Health Care System adminlogin.php sql injection (medium 6.9)
- [CVE-2024-10738](https://insights.sbomify.com/CVE-2024-10738/): itsourcecode Farm Management System manage-breed.php sql injection (medium 5.3)
- [CVE-2024-10737](https://insights.sbomify.com/CVE-2024-10737/): Codezips Free Exam Hall Seating Management System teacher.php sql injection (medium 6.9)
- [CVE-2024-10736](https://insights.sbomify.com/CVE-2024-10736/): Codezips Free Exam Hall Seating Management System student.php sql injection (medium 6.9)
- [CVE-2024-10735](https://insights.sbomify.com/CVE-2024-10735/): Project Worlds Life Insurance Management System editNominee.php sql injection (medium 5.3)
- [CVE-2024-10734](https://insights.sbomify.com/CVE-2024-10734/): Project Worlds Life Insurance Management System editPayment.php sql injection (medium 5.3)
- [CVE-2024-10733](https://insights.sbomify.com/CVE-2024-10733/): code-projects Restaurant Order System login.php sql injection (medium 6.9)
- [CVE-2024-10732](https://insights.sbomify.com/CVE-2024-10732/): Tongda OA 2017 index.php sql injection (medium 5.3)
- [CVE-2024-10731](https://insights.sbomify.com/CVE-2024-10731/): Tongda OA check_seal.php sql injection (medium 5.3)
- [CVE-2024-10730](https://insights.sbomify.com/CVE-2024-10730/): Tongda OA web_show.php sql injection (medium 5.3)
- [CVE-2024-1073](https://insights.sbomify.com/CVE-2024-1073/): SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10729](https://insights.sbomify.com/CVE-2024-10729/): Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update (high 8.8)
- [CVE-2024-10728](https://insights.sbomify.com/CVE-2024-10728/): PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation (high 8.8)
- [CVE-2024-10727](https://insights.sbomify.com/CVE-2024-10727/): Cross-Site Scripting (XSS) in phpipam/phpipam (low 3.5)
- [CVE-2024-10726](https://insights.sbomify.com/CVE-2024-10726/): Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10725](https://insights.sbomify.com/CVE-2024-10725/): Stored Cross-site Scripting (XSS) in phpipam/phpipam (low 3.5)
- [CVE-2024-10724](https://insights.sbomify.com/CVE-2024-10724/): Stored XSS in IPV6 Section in phpipam/phpipam (low 3.5)
- [CVE-2024-10723](https://insights.sbomify.com/CVE-2024-10723/): Stored XSS in phpipam/phpipam (low 3.5)
- [CVE-2024-10722](https://insights.sbomify.com/CVE-2024-10722/): Stored Cross-site Scripting (XSS) in phpipam/phpipam (low 3.5)
- [CVE-2024-10721](https://insights.sbomify.com/CVE-2024-10721/): Store XSS in phpipam/phpipam (low 3.5)
- [CVE-2024-10720](https://insights.sbomify.com/CVE-2024-10720/): Stored Cross-site Scripting (XSS) in phpipam/phpipam (high 8.2)
- [CVE-2024-1072](https://insights.sbomify.com/CVE-2024-1072/): Missing authorization in Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (high 8.2)
- [CVE-2024-10719](https://insights.sbomify.com/CVE-2024-10719/): Stored Cross-site Scripting (XSS) in phpipam/phpipam (low 2.4)
- [CVE-2024-10718](https://insights.sbomify.com/CVE-2024-10718/): Cookie without Secure attribute in phpipam/phpipam (medium 5.3)
- [CVE-2024-10717](https://insights.sbomify.com/CVE-2024-10717/): Styler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license (medium 6.5)
- [CVE-2024-10716](https://insights.sbomify.com/CVE-2024-10716/): Cross-site scripting in Pega Infinity (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/504/