# Vulnerabilities published in 2024


- [CVE-2024-10429](https://insights.sbomify.com/CVE-2024-10429/): WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injection (high 8.6)
- [CVE-2024-10428](https://insights.sbomify.com/CVE-2024-10428/): WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injection (high 8.6)
- [CVE-2024-10427](https://insights.sbomify.com/CVE-2024-10427/): Codezips Pet Shop Management System deleteanimal.php sql injection (medium 5.3)
- [CVE-2024-10426](https://insights.sbomify.com/CVE-2024-10426/): Codezips Pet Shop Management System animalsadd.php sql injection (medium 5.3)
- [CVE-2024-10425](https://insights.sbomify.com/CVE-2024-10425/): Project Worlds Student Project Allocation System Project Selection Page move_up_project.php sql injection (medium 5.3)
- [CVE-2024-10424](https://insights.sbomify.com/CVE-2024-10424/): Project Worlds Student Project Allocation System Project Selection Page remove_project.php sql injection (medium 5.3)
- [CVE-2024-10423](https://insights.sbomify.com/CVE-2024-10423/): Project Worlds Student Project Allocation System Project Selection Page project_selection.php sql injection (medium 5.3)
- [CVE-2024-10422](https://insights.sbomify.com/CVE-2024-10422/): SourceCodester Attendance and Payroll System overtime_add.php sql injection (medium 5.3)
- [CVE-2024-10421](https://insights.sbomify.com/CVE-2024-10421/): SourceCodester Attendance and Payroll System overtime_row.php sql injection (medium 5.3)
- [CVE-2024-10420](https://insights.sbomify.com/CVE-2024-10420/): SourceCodester Attendance and Payroll System update.php upload unrestricted upload (medium 5.3)
- [CVE-2024-1042](https://insights.sbomify.com/CVE-2024-1042/): Missing authorization in WP Radio – Worldwide Online Radio Stations Directory for WordPress (medium 6.4)
- [CVE-2024-10419](https://insights.sbomify.com/CVE-2024-10419/): code-projects Blood Bank Management System bloodrequest.php cross site scripting (medium 5.3)
- [CVE-2024-10418](https://insights.sbomify.com/CVE-2024-10418/): code-projects Blood Bank Management System infoAdd.php sql injection (medium 5.3)
- [CVE-2024-10417](https://insights.sbomify.com/CVE-2024-10417/): code-projects Blood Bank Management System delete.php sql injection (medium 5.3)
- [CVE-2024-10416](https://insights.sbomify.com/CVE-2024-10416/): code-projects Blood Bank Management System cancel.php sql injection (medium 5.3)
- [CVE-2024-10415](https://insights.sbomify.com/CVE-2024-10415/): code-projects Blood Bank Management System accept.php sql injection (medium 5.3)
- [CVE-2024-10414](https://insights.sbomify.com/CVE-2024-10414/): PHPGurukul Vehicle Record System edit-brand.php cross site scripting (medium 5.1)
- [CVE-2024-10413](https://insights.sbomify.com/CVE-2024-10413/): SourceCodester Online Hotel Reservation System update.php upload unrestricted upload (medium 5.3)
- [CVE-2024-10412](https://insights.sbomify.com/CVE-2024-10412/): Poco-z Guns-Medical File Upload upload cross site scripting (medium 5.3)
- [CVE-2024-10411](https://insights.sbomify.com/CVE-2024-10411/): SourceCodester Online Hotel Reservation System controller.php doCheckout sql injection (medium 5.3)
- [CVE-2024-10410](https://insights.sbomify.com/CVE-2024-10410/): SourceCodester Online Hotel Reservation System controller.php upload unrestricted upload (medium 5.3)
- [CVE-2024-1041](https://insights.sbomify.com/CVE-2024-1041/): Cross-site scripting in WP Radio – Worldwide Online Radio Stations Directory for WordPress (medium 6.4)
- [CVE-2024-10409](https://insights.sbomify.com/CVE-2024-10409/): code-projects Blood Bank Management accept.php sql injection (medium 5.3)
- [CVE-2024-10408](https://insights.sbomify.com/CVE-2024-10408/): code-projects Blood Bank Management abs.php sql injection (medium 5.3)
- [CVE-2024-10407](https://insights.sbomify.com/CVE-2024-10407/): SourceCodester Petrol Pump Management Software edit_customer.php sql injection (medium 5.3)
- [CVE-2024-10406](https://insights.sbomify.com/CVE-2024-10406/): SourceCodester Petrol Pump Management Software edit_fuel.php sql injection (medium 5.3)
- [CVE-2024-10405](https://insights.sbomify.com/CVE-2024-10405/): Weak TLS Ciphers on Brocade SANnav port 443 & 18082 (medium 6.9)
- [CVE-2024-10404](https://insights.sbomify.com/CVE-2024-10404/): Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave (medium 5.5)
- [CVE-2024-10403](https://insights.sbomify.com/CVE-2024-10403/): SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav (medium 5.9)
- [CVE-2024-10402](https://insights.sbomify.com/CVE-2024-10402/): Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (high 7.5)
- [CVE-2024-10400](https://insights.sbomify.com/CVE-2024-10400/): Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter (high 7.5)
- [CVE-2024-1040](https://insights.sbomify.com/CVE-2024-1040/): Use of a Broken or Risky Cryptographic Algorithm in Gessler GmbH WEB-MASTER (medium 4.4)
- [CVE-2024-10399](https://insights.sbomify.com/CVE-2024-10399/): Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure (medium 4.3)
- [CVE-2024-10397](https://insights.sbomify.com/CVE-2024-10397/): Preallocated buffer overflows in XDR responses (high 7.7)
- [CVE-2024-10396](https://insights.sbomify.com/CVE-2024-10396/): Fileserver crash and possible information leak on StoreACL/FetchACL (medium 6.5)
- [CVE-2024-10395](https://insights.sbomify.com/CVE-2024-10395/): net: lib: http_server: Buffer Under-read (high 8.6)
- [CVE-2024-10394](https://insights.sbomify.com/CVE-2024-10394/): Theft of credentials in Unix client PAGs (high 8.4)
- [CVE-2024-10393](https://insights.sbomify.com/CVE-2024-10393/): Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration (medium 5.3)
- [CVE-2024-10392](https://insights.sbomify.com/CVE-2024-10392/): AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-10390](https://insights.sbomify.com/CVE-2024-10390/): Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1039](https://insights.sbomify.com/CVE-2024-1039/): Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER (critical 9.8)
- [CVE-2024-10389](https://insights.sbomify.com/CVE-2024-10389/): Path Traversal in Safearchive (medium 5.9)
- [CVE-2024-10388](https://insights.sbomify.com/CVE-2024-10388/): WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-10387](https://insights.sbomify.com/CVE-2024-10387/): Rockwell Automation FactoryTalk ThinManager Denial-of-Service Vulnerability (high 8.7)
- [CVE-2024-10386](https://insights.sbomify.com/CVE-2024-10386/): Rockwell Automation FactoryTalk ThinManager Authentication Vulnerability (critical 9.3)
- [CVE-2024-10385](https://insights.sbomify.com/CVE-2024-10385/): Stored XSS in DirectAdmin Evo Skin (high 8.6)
- [CVE-2024-10383](https://insights.sbomify.com/CVE-2024-10383/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork (high 8.7)
- [CVE-2024-10382](https://insights.sbomify.com/CVE-2024-10382/): Arbitrary Code execution in Car App Android Jetpack Library (high 7.3)
- [CVE-2024-10381](https://insights.sbomify.com/CVE-2024-10381/): Authentication Bypass Vulnerability in Matrix Door Controller (critical 9.3)
- [CVE-2024-10380](https://insights.sbomify.com/CVE-2024-10380/): SourceCodester Petrol Pump Management Software ajax_product.php sql injection (medium 5.3)
- [CVE-2024-1038](https://insights.sbomify.com/CVE-2024-1038/): Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting (medium 5.4)
- [CVE-2024-10379](https://insights.sbomify.com/CVE-2024-10379/): ESAFENET CDG DecryptApplicationService.java actionViewDecyptFile path traversal (medium 5.3)
- [CVE-2024-10378](https://insights.sbomify.com/CVE-2024-10378/): ESAFENET CDG CDGRenewApplicationService.java actionViewCDGRenewFile sql injection (medium 5.3)
- [CVE-2024-10377](https://insights.sbomify.com/CVE-2024-10377/): ESAFENET CDG DecryptApplicationService.java actionPassDecryptApplication1 sql injection (medium 5.3)
- [CVE-2024-10376](https://insights.sbomify.com/CVE-2024-10376/): ESAFENET CDG AutoSignService.java actionPassOrNotAutoSign sql injection (medium 5.3)
- [CVE-2024-10374](https://insights.sbomify.com/CVE-2024-10374/): WP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode (medium 6.4)
- [CVE-2024-10372](https://insights.sbomify.com/CVE-2024-10372/): chidiwilliams buzz model_loader.py download_model temp file (low 2.0)
- [CVE-2024-10371](https://insights.sbomify.com/CVE-2024-10371/): SourceCodester Payroll Management System main login buffer overflow (medium 5.3)
- [CVE-2024-10370](https://insights.sbomify.com/CVE-2024-10370/): Codezips Sales Management System addcustind.php sql injection (medium 6.9)
- [CVE-2024-1037](https://insights.sbomify.com/CVE-2024-1037/): All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10369](https://insights.sbomify.com/CVE-2024-10369/): Codezips Sales Management System addcustcom.php sql injection (medium 6.9)
- [CVE-2024-10368](https://insights.sbomify.com/CVE-2024-10368/): Codezips Sales Management System addstock.php sql injection (medium 6.9)
- [CVE-2024-10367](https://insights.sbomify.com/CVE-2024-10367/): Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (medium 6.4)
- [CVE-2024-10366](https://insights.sbomify.com/CVE-2024-10366/): IDOR in delete attachments in danny-avila/librechat (high 7.6)
- [CVE-2024-10365](https://insights.sbomify.com/CVE-2024-10365/): Information disclosure in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 4.3)
- [CVE-2024-10363](https://insights.sbomify.com/CVE-2024-10363/): Improper Access Control in danny-avila/LibreChat (medium 5.4)
- [CVE-2024-10362](https://insights.sbomify.com/CVE-2024-10362/): Social Media Share Buttons < 2.9.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10361](https://insights.sbomify.com/CVE-2024-10361/): Arbitrary File Deletion via Path Traversal in danny-avila/librechat (high 8.1)
- [CVE-2024-10360](https://insights.sbomify.com/CVE-2024-10360/): Information disclosure in Move Addons for Elementor (medium 4.3)
- [CVE-2024-1036](https://insights.sbomify.com/CVE-2024-1036/): openBI Icon Screen.php uploadIcon unrestricted upload (high 7.3)
- [CVE-2024-10359](https://insights.sbomify.com/CVE-2024-10359/): Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat (medium 4.6)
- [CVE-2024-10357](https://insights.sbomify.com/CVE-2024-10357/): Information disclosure in Clever Addons for Elementor (medium 4.3)
- [CVE-2024-10356](https://insights.sbomify.com/CVE-2024-10356/): Information disclosure in ElementsReady Addons for Elementor (medium 4.3)
- [CVE-2024-10355](https://insights.sbomify.com/CVE-2024-10355/): SourceCodester Petrol Pump Management Software invoice.php sql injection (medium 5.1)
- [CVE-2024-10354](https://insights.sbomify.com/CVE-2024-10354/): SourceCodester Petrol Pump Management Software print.php sql injection (medium 5.1)
- [CVE-2024-10353](https://insights.sbomify.com/CVE-2024-10353/): SourceCodester Online Exam System admin-dashboard access control (medium 5.3)
- [CVE-2024-10352](https://insights.sbomify.com/CVE-2024-10352/): Information disclosure in Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) (medium 4.3)
- [CVE-2024-10351](https://insights.sbomify.com/CVE-2024-10351/): Tenda RX9 Pro POST Request setMacFilterCfg sub_424CE0 stack-based overflow (high 8.7)
- [CVE-2024-10350](https://insights.sbomify.com/CVE-2024-10350/): code-projects Hospital Management System add-doctor.php sql injection (medium 5.1)
- [CVE-2024-1035](https://insights.sbomify.com/CVE-2024-1035/): openBI Icon.php uploadIcon unrestricted upload (high 7.3)
- [CVE-2024-10349](https://insights.sbomify.com/CVE-2024-10349/): SourceCodester Best House Rental Management System ajax.php delete_tenant sql injection (medium 5.3)
- [CVE-2024-10348](https://insights.sbomify.com/CVE-2024-10348/): SourceCodester Best House Rental Management System Manage Tenant Details index.php cross site scripting (medium 5.3)
- [CVE-2024-10345](https://insights.sbomify.com/CVE-2024-10345/): Unauthenticated Denial of Service via Shutdown Function (high 8.7)
- [CVE-2024-10344](https://insights.sbomify.com/CVE-2024-10344/): Unauthenticated Denial of Service via Refuse Function (high 8.7)
- [CVE-2024-10343](https://insights.sbomify.com/CVE-2024-10343/): Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-10342](https://insights.sbomify.com/CVE-2024-10342/): League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-10341](https://insights.sbomify.com/CVE-2024-10341/): League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) SQL Injection via Shortcode (medium 6.5)
- [CVE-2024-10340](https://insights.sbomify.com/CVE-2024-10340/): Shortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1034](https://insights.sbomify.com/CVE-2024-1034/): openBI File.php uploadFile unrestricted upload (high 7.3)
- [CVE-2024-10338](https://insights.sbomify.com/CVE-2024-10338/): SourceCodeHero Clothes Recommendation System home.php sql injection (medium 5.1)
- [CVE-2024-10337](https://insights.sbomify.com/CVE-2024-10337/): SourceCodeHero Clothes Recommendation System home.php sql injection (medium 5.1)
- [CVE-2024-10336](https://insights.sbomify.com/CVE-2024-10336/): SourceCodeHero Clothes Recommendation System Admin Login Page index.php sql injection (medium 6.9)
- [CVE-2024-10335](https://insights.sbomify.com/CVE-2024-10335/): SourceCodester Garbage Collection Management System login.php sql injection (medium 6.9)
- [CVE-2024-10334](https://insights.sbomify.com/CVE-2024-10334/): Camera passwords stored in clear text (high 7.0)
- [CVE-2024-10332](https://insights.sbomify.com/CVE-2024-10332/): Cross-site scripting in Janto (medium 6.1)
- [CVE-2024-10331](https://insights.sbomify.com/CVE-2024-10331/): PHPGurukul Vehicle Record System search-vehicle.php sql injection (medium 5.3)
- [CVE-2024-10330](https://insights.sbomify.com/CVE-2024-10330/): Improper Access Control in lunary-ai/lunary (medium 6.5)
- [CVE-2024-1033](https://insights.sbomify.com/CVE-2024-1033/): openBI Datament.php agent information disclosure (medium 4.3)
- [CVE-2024-10329](https://insights.sbomify.com/CVE-2024-10329/): Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure (medium 4.3)
- [CVE-2024-10327](https://insights.sbomify.com/CVE-2024-10327/): Auth bypass in Okta Verify for iOS (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/508/