# Vulnerabilities published in 2024


- [CVE-2024-1022](https://insights.sbomify.com/CVE-2024-1022/): CodeAstro Simple Student Result Management System Add Class Page add_classes.php cross site scripting (low 2.4)
- [CVE-2024-10219](https://insights.sbomify.com/CVE-2024-10219/): Incorrect Authorization in GitLab (medium 6.5)
- [CVE-2024-10218](https://insights.sbomify.com/CVE-2024-10218/): TIBCO Hawk Stored-XEE Vulnerability (critical 9.2)
- [CVE-2024-10217](https://insights.sbomify.com/CVE-2024-10217/): TIBCO Hawk Stored-XSS Vulnerability (critical 9.2)
- [CVE-2024-10216](https://insights.sbomify.com/CVE-2024-10216/): Missing authorization in WP User Manager – User Profile Builder & Membership (medium 4.3)
- [CVE-2024-10215](https://insights.sbomify.com/CVE-2024-10215/): WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change (critical 9.8)
- [CVE-2024-10214](https://insights.sbomify.com/CVE-2024-10214/): Incorrect Session Creation with Desktop SSO (low 3.5)
- [CVE-2024-10210](https://insights.sbomify.com/CVE-2024-10210/): Path traversal in APROL Web Portal (high 8.4)
- [CVE-2024-1021](https://insights.sbomify.com/CVE-2024-1021/): Rebuild HTTP Request readRawText server-side request forgery (medium 6.3)
- [CVE-2024-10209](https://insights.sbomify.com/CVE-2024-10209/): Incorrect Permission Assignment in APROL file system (high 8.5)
- [CVE-2024-10208](https://insights.sbomify.com/CVE-2024-10208/): Cross Site Scripting vulnerability in APROL Web Portal (medium 5.1)
- [CVE-2024-10207](https://insights.sbomify.com/CVE-2024-10207/): Server-Side Request Forgery (authenticated) in APROL Web Portal (medium 5.3)
- [CVE-2024-10206](https://insights.sbomify.com/CVE-2024-10206/): Server-Side Request Forgery (unauthenticated) in APROL Web Portal (medium 6.9)
- [CVE-2024-10205](https://insights.sbomify.com/CVE-2024-10205/): Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer (critical 9.4)
- [CVE-2024-10204](https://insights.sbomify.com/CVE-2024-10204/): Memory corruption in eDrawings (high 7.8)
- [CVE-2024-10203](https://insights.sbomify.com/CVE-2024-10203/): Agent Arbitrary File Deletion (high 7.0)
- [CVE-2024-10202](https://insights.sbomify.com/CVE-2024-10202/): Wellchoose Administrative Management System - OS Command Injection (high 8.8)
- [CVE-2024-10201](https://insights.sbomify.com/CVE-2024-10201/): Wellchoose Administrative Management System - Arbitrary File Upload (high 8.8)
- [CVE-2024-10200](https://insights.sbomify.com/CVE-2024-10200/): Wellchoose Administrative Management System - Arbitrary File Read through Path Traversal (high 7.5)
- [CVE-2024-1020](https://insights.sbomify.com/CVE-2024-1020/): Rebuild proxy-download getStorageFile cross site scripting (low 3.5)
- [CVE-2024-10199](https://insights.sbomify.com/CVE-2024-10199/): code-projects Pharmacy Management System Manage Medicines Page manage_medicine.php cross site scripting (medium 5.1)
- [CVE-2024-10198](https://insights.sbomify.com/CVE-2024-10198/): code-projects Pharmacy Management System Manage Customer Page manage_customer.php cross site scripting (medium 5.1)
- [CVE-2024-10197](https://insights.sbomify.com/CVE-2024-10197/): code-projects Pharmacy Management System Manage Supplier Page manage_supplier.php cross site scripting (medium 5.1)
- [CVE-2024-10196](https://insights.sbomify.com/CVE-2024-10196/): code-projects Pharmacy Management System add_new_invoice.php sql injection (medium 5.3)
- [CVE-2024-10195](https://insights.sbomify.com/CVE-2024-10195/): Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection (medium 5.1)
- [CVE-2024-10194](https://insights.sbomify.com/CVE-2024-10194/): WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto_chidx stack-based overflow (high 8.7)
- [CVE-2024-10193](https://insights.sbomify.com/CVE-2024-10193/): WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injection (medium 5.1)
- [CVE-2024-10192](https://insights.sbomify.com/CVE-2024-10192/): PHPGurukul IFSC Code Finder Project search.php cross site scripting (medium 5.3)
- [CVE-2024-10191](https://insights.sbomify.com/CVE-2024-10191/): PHPGurukul Boat Booking System Booking Details Page book-details.php cross site scripting (medium 5.3)
- [CVE-2024-10190](https://insights.sbomify.com/CVE-2024-10190/): Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod (critical 9.8)
- [CVE-2024-1019](https://insights.sbomify.com/CVE-2024-1019/): WAF bypass of the ModSecurity v3 release line (high 8.6)
- [CVE-2024-10189](https://insights.sbomify.com/CVE-2024-10189/): Cross-site scripting in Anchor Episodes Index (Spotify for Podcasters) (medium 6.4)
- [CVE-2024-10188](https://insights.sbomify.com/CVE-2024-10188/): Denial of Service in BerriAI/litellm (high 7.5)
- [CVE-2024-10187](https://insights.sbomify.com/CVE-2024-10187/): myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode (medium 6.4)
- [CVE-2024-10186](https://insights.sbomify.com/CVE-2024-10186/): Event Post <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode (medium 6.4)
- [CVE-2024-10185](https://insights.sbomify.com/CVE-2024-10185/): Cross-site scripting in StreamWeasels YouTube Integration (medium 6.4)
- [CVE-2024-10184](https://insights.sbomify.com/CVE-2024-10184/): Cross-site scripting in StreamWeasels Kick Integration (medium 6.4)
- [CVE-2024-10183](https://insights.sbomify.com/CVE-2024-10183/): Arbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege Escalation (medium 5.2)
- [CVE-2024-10182](https://insights.sbomify.com/CVE-2024-10182/): Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (medium 6.4)
- [CVE-2024-10181](https://insights.sbomify.com/CVE-2024-10181/): Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode (medium 6.4)
- [CVE-2024-10180](https://insights.sbomify.com/CVE-2024-10180/): Cross-site scripting in Contact Form 7 – Repeatable Fields (medium 6.4)
- [CVE-2024-1018](https://insights.sbomify.com/CVE-2024-1018/): PbootCMS cross site scripting (low 2.4)
- [CVE-2024-10179](https://insights.sbomify.com/CVE-2024-10179/): Cross-site scripting in Slickstream: Engagement and Conversions (medium 6.4)
- [CVE-2024-10178](https://insights.sbomify.com/CVE-2024-10178/): Cross-site scripting in Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor (medium 6.4)
- [CVE-2024-10177](https://insights.sbomify.com/CVE-2024-10177/): Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode (medium 6.4)
- [CVE-2024-10176](https://insights.sbomify.com/CVE-2024-10176/): Cross-site scripting in Compact WP Audio Player (medium 6.4)
- [CVE-2024-10175](https://insights.sbomify.com/CVE-2024-10175/): Cross-site scripting in Pricing Tables For WPBakery Page Builder (formerly Visual Composer) (medium 6.4)
- [CVE-2024-10174](https://insights.sbomify.com/CVE-2024-10174/): Auth bypass in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (high 7.3)
- [CVE-2024-10173](https://insights.sbomify.com/CVE-2024-10173/): didi DDMQ Console Module improper authentication (medium 6.9)
- [CVE-2024-10172](https://insights.sbomify.com/CVE-2024-10172/): Cross-site scripting in Innovs WPBakery Visual Composer WHMCS Elements (medium 6.4)
- [CVE-2024-10171](https://insights.sbomify.com/CVE-2024-10171/): code-projects Blood Bank System massage.php sql injection (medium 5.1)
- [CVE-2024-10170](https://insights.sbomify.com/CVE-2024-10170/): code-projects Hospital Management System get_doctor.php sql injection (medium 5.3)
- [CVE-2024-1017](https://insights.sbomify.com/CVE-2024-1017/): Gabriels FTP Server denial of service (medium 5.3)
- [CVE-2024-10169](https://insights.sbomify.com/CVE-2024-10169/): code-projects Hospital Management System change-password.php sql injection (medium 5.3)
- [CVE-2024-10168](https://insights.sbomify.com/CVE-2024-10168/): Cross-site scripting in Active Products Tables for WooCommerce. Use constructor to create tables (medium 6.4)
- [CVE-2024-10167](https://insights.sbomify.com/CVE-2024-10167/): Codezips Sales Management System deletecustind.php sql injection (medium 6.9)
- [CVE-2024-10166](https://insights.sbomify.com/CVE-2024-10166/): Codezips Sales Management System checkuser.php sql injection (medium 6.9)
- [CVE-2024-10165](https://insights.sbomify.com/CVE-2024-10165/): Codezips Sales Management System deletecustcom.php sql injection (medium 6.9)
- [CVE-2024-10164](https://insights.sbomify.com/CVE-2024-10164/): Cross-site scripting in Premium Packages – Sell Digital Products Securely (medium 6.4)
- [CVE-2024-10163](https://insights.sbomify.com/CVE-2024-10163/): SourceCodester Sentiment Based Movie Rating System movie_details.php sql injection (medium 5.3)
- [CVE-2024-10162](https://insights.sbomify.com/CVE-2024-10162/): PHPGurukul Boat Booking System Edit Subdomain Details Page edit-subadmin.php sql injection (medium 5.3)
- [CVE-2024-10161](https://insights.sbomify.com/CVE-2024-10161/): PHPGurukul Boat Booking System Update Boat Image Page change-image.php unrestricted upload (medium 5.3)
- [CVE-2024-10160](https://insights.sbomify.com/CVE-2024-10160/): PHPGurukul Boat Booking System BW Dates Report Page bwdates-report-details.php sql injection (medium 5.3)
- [CVE-2024-1016](https://insights.sbomify.com/CVE-2024-1016/): Solar FTP Server PASV Command denial of service (medium 5.3)
- [CVE-2024-10159](https://insights.sbomify.com/CVE-2024-10159/): PHPGurukul Boat Booking System My Profile Page profile.php sql injection (medium 6.9)
- [CVE-2024-10158](https://insights.sbomify.com/CVE-2024-10158/): PHPGurukul Boat Booking System session_start session fixiation (medium 6.9)
- [CVE-2024-10157](https://insights.sbomify.com/CVE-2024-10157/): PHPGurukul Boat Booking System Reset Your Password Page password-recovery.php sql injection (medium 6.9)
- [CVE-2024-10156](https://insights.sbomify.com/CVE-2024-10156/): PHPGurukul Boat Booking System Sign In Page index.php sql injection (medium 6.9)
- [CVE-2024-10155](https://insights.sbomify.com/CVE-2024-10155/): PHPGurukul Boat Booking System Book a Boat Page book-boat.php cross site scripting (medium 5.3)
- [CVE-2024-10154](https://insights.sbomify.com/CVE-2024-10154/): PHPGurukul Boat Booking System Check Booking Status Page status.php sql injection (medium 5.3)
- [CVE-2024-10153](https://insights.sbomify.com/CVE-2024-10153/): PHPGurukul Boat Booking System Book a Boat Page book-boat.php sql injection (medium 5.3)
- [CVE-2024-10152](https://insights.sbomify.com/CVE-2024-10152/): Simple Certain Time to Show Content < 1.3.1 - Reflected XSS (high 7.1)
- [CVE-2024-10151](https://insights.sbomify.com/CVE-2024-10151/): Auto iFrame < 2.0 - Contributor+ XSS via Shortcode (medium 5.4)
- [CVE-2024-10150](https://insights.sbomify.com/CVE-2024-10150/): Bamazoo – Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode (medium 6.4)
- [CVE-2024-1015](https://insights.sbomify.com/CVE-2024-1015/): Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 (critical 9.8)
- [CVE-2024-10149](https://insights.sbomify.com/CVE-2024-10149/): Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets (medium 4.8)
- [CVE-2024-10148](https://insights.sbomify.com/CVE-2024-10148/): Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode (medium 6.4)
- [CVE-2024-10147](https://insights.sbomify.com/CVE-2024-10147/): Steel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode (medium 6.4)
- [CVE-2024-10146](https://insights.sbomify.com/CVE-2024-10146/): Simple File List < 6.1.13 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2024-10145](https://insights.sbomify.com/CVE-2024-10145/): Hubbub Lite < 1.34.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10144](https://insights.sbomify.com/CVE-2024-10144/): Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS (medium 4.8)
- [CVE-2024-10143](https://insights.sbomify.com/CVE-2024-10143/): MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10142](https://insights.sbomify.com/CVE-2024-10142/): code-projects Blood Bank System viewrequest.php cross site scripting (medium 5.3)
- [CVE-2024-10141](https://insights.sbomify.com/CVE-2024-10141/): jsbroks COCO Annotator Session predictable state (medium 6.3)
- [CVE-2024-10140](https://insights.sbomify.com/CVE-2024-10140/): code-projects Pharmacy Management System manage_supplier.php sql injection (medium 5.3)
- [CVE-2024-1014](https://insights.sbomify.com/CVE-2024-1014/): Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 (medium 6.2)
- [CVE-2024-10139](https://insights.sbomify.com/CVE-2024-10139/): code-projects Pharmacy Management System add_new_supplier.php sql injection (medium 5.3)
- [CVE-2024-10138](https://insights.sbomify.com/CVE-2024-10138/): code-projects Pharmacy Management System add_new_purchase.php sql injection (medium 5.3)
- [CVE-2024-10137](https://insights.sbomify.com/CVE-2024-10137/): code-projects Pharmacy Management System manage_medicine.php sql injection (medium 5.3)
- [CVE-2024-10136](https://insights.sbomify.com/CVE-2024-10136/): code-projects Pharmacy Management System manage_invoice.php sql injection (medium 5.3)
- [CVE-2024-10135](https://insights.sbomify.com/CVE-2024-10135/): ESAFENET CDG NetSecConfigService.java actionDelNetSecConfig sql injection (medium 5.3)
- [CVE-2024-10134](https://insights.sbomify.com/CVE-2024-10134/): ESAFENET CDG MultiServerAjax.java connectLogout sql injection (medium 5.3)
- [CVE-2024-10133](https://insights.sbomify.com/CVE-2024-10133/): ESAFENET CDG NetSecPolicyAjax.java updateNetSecPolicyPriority sql injection (medium 5.3)
- [CVE-2024-10131](https://insights.sbomify.com/CVE-2024-10131/): Remote Code Execution in infiniflow/ragflow (high 8.8)
- [CVE-2024-10130](https://insights.sbomify.com/CVE-2024-10130/): Tenda AC8 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow (high 8.7)
- [CVE-2024-1013](https://insights.sbomify.com/CVE-2024-1013/): Unixodbc: out of bounds stack write due to pointer-to-integer types conversion (high 7.8)
- [CVE-2024-10129](https://insights.sbomify.com/CVE-2024-10129/): HFO4 shudong-share Share create_share.php sql injection (medium 5.3)
- [CVE-2024-10128](https://insights.sbomify.com/CVE-2024-10128/): Topdata Inner Rep Plus WebServer td.js.gz risky encryption (medium 5.1)
- [CVE-2024-10127](https://insights.sbomify.com/CVE-2024-10127/): Support for authentication bypass condition in M-Files LDAP authentication (critical 9.2)
- [CVE-2024-10126](https://insights.sbomify.com/CVE-2024-10126/): Local file inclusion vulnerability in M-Files Server (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/510/