# Vulnerabilities published in 2024


- [CVE-2024-10715](https://insights.sbomify.com/CVE-2024-10715/): MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block (medium 6.4)
- [CVE-2024-10714](https://insights.sbomify.com/CVE-2024-10714/): Denial of Service in binary-husky/gpt_academic (high 7.5)
- [CVE-2024-10713](https://insights.sbomify.com/CVE-2024-10713/): Denial of Service (DoS) via Multipart Request in szad670401/hyperlpr (high 7.5)
- [CVE-2024-10711](https://insights.sbomify.com/CVE-2024-10711/): WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update (high 8.8)
- [CVE-2024-10710](https://insights.sbomify.com/CVE-2024-10710/): YaDisk Files <= 1.2.5 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-1071](https://insights.sbomify.com/CVE-2024-1071/): SQL injection in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (critical 9.8)
- [CVE-2024-10709](https://insights.sbomify.com/CVE-2024-10709/): YaDisk Files <= 1.2.5 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2024-10708](https://insights.sbomify.com/CVE-2024-10708/): System Dashboard < 2.8.15 - Admin+ Path Traversal (medium 4.9)
- [CVE-2024-10707](https://insights.sbomify.com/CVE-2024-10707/): Local File Inclusion in gaizhenbiao/chuanhuchatgpt (medium 6.5)
- [CVE-2024-10706](https://insights.sbomify.com/CVE-2024-10706/): Download Manager < 3.3.03 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10705](https://insights.sbomify.com/CVE-2024-10705/): Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl (medium 5.4)
- [CVE-2024-10704](https://insights.sbomify.com/CVE-2024-10704/): Photo Gallery by 10Web < 1.8.31 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10703](https://insights.sbomify.com/CVE-2024-10703/): Registrations for The Events Calendar < 2.13.4 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-10702](https://insights.sbomify.com/CVE-2024-10702/): code-projects Simple Car Rental System signup.php sql injection (medium 6.9)
- [CVE-2024-10701](https://insights.sbomify.com/CVE-2024-10701/): PHPGurukul Car Rental Portal search.php cross site scripting (medium 5.3)
- [CVE-2024-10700](https://insights.sbomify.com/CVE-2024-10700/): code-projects University Event Management System submit.php sql injection (medium 5.3)
- [CVE-2024-1070](https://insights.sbomify.com/CVE-2024-1070/): SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10699](https://insights.sbomify.com/CVE-2024-10699/): code-projects Wazifa System logincontrol.php sql injection (medium 6.9)
- [CVE-2024-10698](https://insights.sbomify.com/CVE-2024-10698/): Tenda AC6 SetOnlineDevName formSetDeviceName stack-based overflow (high 8.7)
- [CVE-2024-10697](https://insights.sbomify.com/CVE-2024-10697/): Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection (medium 5.3)
- [CVE-2024-10696](https://insights.sbomify.com/CVE-2024-10696/): Missing authorization in UltraAddons for Elementor (medium 4.3)
- [CVE-2024-10695](https://insights.sbomify.com/CVE-2024-10695/): Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10693](https://insights.sbomify.com/CVE-2024-10693/): SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10692](https://insights.sbomify.com/CVE-2024-10692/): Information disclosure in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (medium 4.3)
- [CVE-2024-10690](https://insights.sbomify.com/CVE-2024-10690/): Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-1069](https://insights.sbomify.com/CVE-2024-1069/): Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2024-10689](https://insights.sbomify.com/CVE-2024-10689/): XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10688](https://insights.sbomify.com/CVE-2024-10688/): Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10687](https://insights.sbomify.com/CVE-2024-10687/): SQL injection in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (critical 9.8)
- [CVE-2024-10685](https://insights.sbomify.com/CVE-2024-10685/): Contact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10684](https://insights.sbomify.com/CVE-2024-10684/): Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10683](https://insights.sbomify.com/CVE-2024-10683/): Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10682](https://insights.sbomify.com/CVE-2024-10682/): Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10681](https://insights.sbomify.com/CVE-2024-10681/): Code injection in ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup (medium 6.3)
- [CVE-2024-10680](https://insights.sbomify.com/CVE-2024-10680/): Form Maker by 10Web < 1.15.32 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1068](https://insights.sbomify.com/CVE-2024-1068/): 404 Solution < 2.35.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-10679](https://insights.sbomify.com/CVE-2024-10679/): Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS (medium 6.1)
- [CVE-2024-10678](https://insights.sbomify.com/CVE-2024-10678/): Ultimate Blocks < 3.2.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-10677](https://insights.sbomify.com/CVE-2024-10677/): BTEV <= 2.0.2 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-10676](https://insights.sbomify.com/CVE-2024-10676/): WordPress Conversion Helper plugin <= 1.12 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-10675](https://insights.sbomify.com/CVE-2024-10675/): affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10674](https://insights.sbomify.com/CVE-2024-10674/): Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (high 8.8)
- [CVE-2024-10673](https://insights.sbomify.com/CVE-2024-10673/): Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (high 8.8)
- [CVE-2024-10672](https://insights.sbomify.com/CVE-2024-10672/): Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion (low 2.7)
- [CVE-2024-10671](https://insights.sbomify.com/CVE-2024-10671/): Information disclosure in Button Block – Design Stylish, Interactive, and Multi-Functional Buttons (medium 4.3)
- [CVE-2024-10670](https://insights.sbomify.com/CVE-2024-10670/): Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-1067](https://insights.sbomify.com/CVE-2024-1067/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 7.4)
- [CVE-2024-10669](https://insights.sbomify.com/CVE-2024-10669/): Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-10668](https://insights.sbomify.com/CVE-2024-10668/): Auth Bypass in Quickshare (medium 5.9)
- [CVE-2024-10667](https://insights.sbomify.com/CVE-2024-10667/): Information disclosure in Content Slider Block – Slide Through Text or Media Content (medium 4.3)
- [CVE-2024-10666](https://insights.sbomify.com/CVE-2024-10666/): Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure (medium 4.3)
- [CVE-2024-10665](https://insights.sbomify.com/CVE-2024-10665/): Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion (medium 5.4)
- [CVE-2024-10664](https://insights.sbomify.com/CVE-2024-10664/): Missing authorization in Knowledge Base documentation & wiki plugin – BasePress Docs (medium 4.3)
- [CVE-2024-10663](https://insights.sbomify.com/CVE-2024-10663/): Missing authorization in Eleblog – Elementor Blog And Magazine Addons (medium 4.3)
- [CVE-2024-10662](https://insights.sbomify.com/CVE-2024-10662/): Tenda AC15 SetOnlineDevName formSetDeviceName stack-based overflow (high 8.7)
- [CVE-2024-10661](https://insights.sbomify.com/CVE-2024-10661/): Tenda AC15 SetDlnaCfg stack-based overflow (high 8.7)
- [CVE-2024-10660](https://insights.sbomify.com/CVE-2024-10660/): ESAFENET CDG HookService.java deleteHook sql injection (medium 5.3)
- [CVE-2024-1066](https://insights.sbomify.com/CVE-2024-1066/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-10659](https://insights.sbomify.com/CVE-2024-10659/): ESAFENET CDG CDGAuthoriseTempletService.java delSystemEncryptPolicy sql injection (medium 5.3)
- [CVE-2024-10658](https://insights.sbomify.com/CVE-2024-10658/): Tongda OA check_seal.php sql injection (medium 5.3)
- [CVE-2024-10657](https://insights.sbomify.com/CVE-2024-10657/): Tongda OA prcs_info.php sql injection (medium 5.3)
- [CVE-2024-10656](https://insights.sbomify.com/CVE-2024-10656/): Tongda OA 2017 apply.php sql injection (medium 5.3)
- [CVE-2024-10655](https://insights.sbomify.com/CVE-2024-10655/): Tongda OA 2017 new.php sql injection (medium 5.3)
- [CVE-2024-10654](https://insights.sbomify.com/CVE-2024-10654/): TOTOLINK LR350 formLoginAuth.htm authorization (medium 6.9)
- [CVE-2024-10653](https://insights.sbomify.com/CVE-2024-10653/): CHANGING Information Technology IDExpert - OS Command Injection (high 7.2)
- [CVE-2024-10652](https://insights.sbomify.com/CVE-2024-10652/): CHANGING Information Technology IDExpert - Reflected XSS (medium 6.1)
- [CVE-2024-10651](https://insights.sbomify.com/CVE-2024-10651/): CHANGING Information Technology IDExpert - Arbitrary File Read through Path Traversal (medium 4.9)
- [CVE-2024-10650](https://insights.sbomify.com/CVE-2024-10650/): Denial of Service (DoS) in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-1065](https://insights.sbomify.com/CVE-2024-1065/): Mali GPU Kernel Driver allows improper GPU memory processing operations (medium 5.9)
- [CVE-2024-10649](https://insights.sbomify.com/CVE-2024-10649/): Unauthenticated File Upload in wandb/openui (medium 6.1)
- [CVE-2024-10648](https://insights.sbomify.com/CVE-2024-10648/): Path Traversal in gradio-app/gradio (high 8.2)
- [CVE-2024-10647](https://insights.sbomify.com/CVE-2024-10647/): WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL (medium 6.1)
- [CVE-2024-10646](https://insights.sbomify.com/CVE-2024-10646/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (high 7.2)
- [CVE-2024-10645](https://insights.sbomify.com/CVE-2024-10645/): Blogger 301 Redirect <= 2.5.3 - Unauthenticated SQL Injection via br (high 7.5)
- [CVE-2024-10644](https://insights.sbomify.com/CVE-2024-10644/): Code injection in Connect Secure (critical 9.1)
- [CVE-2024-10640](https://insights.sbomify.com/CVE-2024-10640/): The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-1064](https://insights.sbomify.com/CVE-2024-1064/): Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4 (high 7.5)
- [CVE-2024-10639](https://insights.sbomify.com/CVE-2024-10639/): Auto Prune Posts < 3.0.0- Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10638](https://insights.sbomify.com/CVE-2024-10638/): Product Labels For Woocommerce < 1.5.11 - Admin+ SQLi (medium 4.1)
- [CVE-2024-10637](https://insights.sbomify.com/CVE-2024-10637/): Kadence Blocks < 3.2.54 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-10636](https://insights.sbomify.com/CVE-2024-10636/): Cross-site scripting in Quiz Maker Agency (medium 6.1)
- [CVE-2024-10635](https://insights.sbomify.com/CVE-2024-10635/): Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass (medium 6.1)
- [CVE-2024-10634](https://insights.sbomify.com/CVE-2024-10634/): Nokaut Offers Box <= 1.4.0 - Plugin Reset via CSRF (medium 4.3)
- [CVE-2024-10633](https://insights.sbomify.com/CVE-2024-10633/): Code injection in Quiz Maker Agency (high 7.3)
- [CVE-2024-10632](https://insights.sbomify.com/CVE-2024-10632/): Nokaut Offers Box <= 1.4.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10631](https://insights.sbomify.com/CVE-2024-10631/): Countdown Timer <= 1.0.5 - Contributor+ Stored XSS (medium 6.5)
- [CVE-2024-10630](https://insights.sbomify.com/CVE-2024-10630/): Race condition in Application Control Engine (high 7.8)
- [CVE-2024-1063](https://insights.sbomify.com/CVE-2024-1063/): Server-side request forgery in Appwrite (medium 5.3)
- [CVE-2024-10629](https://insights.sbomify.com/CVE-2024-10629/): GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation (high 8.8)
- [CVE-2024-10628](https://insights.sbomify.com/CVE-2024-10628/): Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id (high 7.5)
- [CVE-2024-10627](https://insights.sbomify.com/CVE-2024-10627/): WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-10626](https://insights.sbomify.com/CVE-2024-10626/): WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.8)
- [CVE-2024-10625](https://insights.sbomify.com/CVE-2024-10625/): WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion (critical 9.8)
- [CVE-2024-10624](https://insights.sbomify.com/CVE-2024-10624/): Regular Expression Denial of Service (ReDoS) in gradio-app/gradio (high 7.5)
- [CVE-2024-10623](https://insights.sbomify.com/CVE-2024-10623/): ForumEngine <= 1.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10621](https://insights.sbomify.com/CVE-2024-10621/): Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-10620](https://insights.sbomify.com/CVE-2024-10620/): knightliao Disconf Configuration Center list improper authentication (medium 6.9)
- [CVE-2024-1062](https://insights.sbomify.com/CVE-2024-1062/): Memory corruption in Red Hat Directory Server 11.5 E4S for RHEL 8 (medium 5.5)
- [CVE-2024-10619](https://insights.sbomify.com/CVE-2024-10619/): Tongda OA 2017 next_detail.php sql injection (medium 5.3)
- [CVE-2024-10618](https://insights.sbomify.com/CVE-2024-10618/): Tongda OA 2017 record_detail.php sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/505/