# Vulnerabilities published in 2024


- [CVE-2024-0483](https://insights.sbomify.com/CVE-2024-0483/): Taokeyun HTTP POST Request Task.php index sql injection (medium 6.3)
- [CVE-2024-0482](https://insights.sbomify.com/CVE-2024-0482/): Taokeyun HTTP POST Request Video.php index sql injection (medium 6.3)
- [CVE-2024-0481](https://insights.sbomify.com/CVE-2024-0481/): Taokeyun HTTP POST Request Goods.php shopGoods sql injection (medium 6.3)
- [CVE-2024-0480](https://insights.sbomify.com/CVE-2024-0480/): Taokeyun HTTP POST Request Drs.php index sql injection (high 7.3)
- [CVE-2024-0479](https://insights.sbomify.com/CVE-2024-0479/): Taokeyun HTTP POST Request User.php login sql injection (high 7.3)
- [CVE-2024-0478](https://insights.sbomify.com/CVE-2024-0478/): code-projects Fighting Cock Information System edit_chicken.php sql injection (medium 6.3)
- [CVE-2024-0477](https://insights.sbomify.com/CVE-2024-0477/): code-projects Fighting Cock Information System update-deworm.php sql injection (medium 6.3)
- [CVE-2024-0476](https://insights.sbomify.com/CVE-2024-0476/): Blood Bank & Donor Management request-received-bydonar.php cross site scripting (low 2.4)
- [CVE-2024-0475](https://insights.sbomify.com/CVE-2024-0475/): code-projects Dormitory Management System modifyuser.php sql injection (medium 6.3)
- [CVE-2024-0474](https://insights.sbomify.com/CVE-2024-0474/): code-projects Dormitory Management System login.php sql injection (high 7.3)
- [CVE-2024-0473](https://insights.sbomify.com/CVE-2024-0473/): code-projects Dormitory Management System comment.php sql injection (medium 6.3)
- [CVE-2024-0472](https://insights.sbomify.com/CVE-2024-0472/): code-projects Dormitory Management System modifyuser.php information disclosure (low 3.5)
- [CVE-2024-0471](https://insights.sbomify.com/CVE-2024-0471/): code-projects Human Resource Integrated System dec_service_credits.php sql injection (medium 6.3)
- [CVE-2024-0470](https://insights.sbomify.com/CVE-2024-0470/): code-projects Human Resource Integrated System inc_service_credits.php sql injection (medium 6.3)
- [CVE-2024-0469](https://insights.sbomify.com/CVE-2024-0469/): code-projects Human Resource Integrated System update_personal_info.php sql injection (medium 6.3)
- [CVE-2024-0468](https://insights.sbomify.com/CVE-2024-0468/): code-projects Fighting Cock Information System new-father.php unrestricted upload (medium 6.3)
- [CVE-2024-0467](https://insights.sbomify.com/CVE-2024-0467/): code-projects Employee Profile Management System edit_position_query.php cross site scripting (low 3.5)
- [CVE-2024-0466](https://insights.sbomify.com/CVE-2024-0466/): code-projects Employee Profile Management System file_table.php sql injection (medium 5.5)
- [CVE-2024-0465](https://insights.sbomify.com/CVE-2024-0465/): code-projects Employee Profile Management System download.php path traversal (low 3.5)
- [CVE-2024-0464](https://insights.sbomify.com/CVE-2024-0464/): code-projects Online Faculty Clearance HTTP GET Request delete_faculty.php sql injection (medium 6.3)
- [CVE-2024-0463](https://insights.sbomify.com/CVE-2024-0463/): code-projects Online Faculty Clearance HTTP POST Request admin_view_info.php sql injection (medium 6.3)
- [CVE-2024-0462](https://insights.sbomify.com/CVE-2024-0462/): code-projects Online Faculty Clearance HTTP POST Request designee_view_status.php sql injection (medium 6.3)
- [CVE-2024-0461](https://insights.sbomify.com/CVE-2024-0461/): code-projects Online Faculty Clearance HTTP POST Request deactivate.php sql injection (medium 6.3)
- [CVE-2024-0460](https://insights.sbomify.com/CVE-2024-0460/): code-projects Faculty Management System student-print.php sql injection (medium 6.3)
- [CVE-2024-0459](https://insights.sbomify.com/CVE-2024-0459/): Blood Bank & Donor Management request-received-bydonar.php sql injection (medium 4.7)
- [CVE-2024-0456](https://insights.sbomify.com/CVE-2024-0456/): Direct Request ('Forced Browsing') in GitLab (medium 4.3)
- [CVE-2024-0455](https://insights.sbomify.com/CVE-2024-0455/): SSRF on AWS deployed instances of AnythingLLM via /metadata (critical 9.9)
- [CVE-2024-0454](https://insights.sbomify.com/CVE-2024-0454/): Security Vulnerability on Match-on-Chip FPR Architecture (medium 6.0)
- [CVE-2024-0453](https://insights.sbomify.com/CVE-2024-0453/): AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback (medium 5.0)
- [CVE-2024-0452](https://insights.sbomify.com/CVE-2024-0452/): AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback (medium 5.0)
- [CVE-2024-0451](https://insights.sbomify.com/CVE-2024-0451/): AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback (medium 5.0)
- [CVE-2024-0450](https://insights.sbomify.com/CVE-2024-0450/): Quoted zip-bomb protection for zipfile (medium 6.2)
- [CVE-2024-0449](https://insights.sbomify.com/CVE-2024-0449/): ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting (medium 4.4)
- [CVE-2024-0448](https://insights.sbomify.com/CVE-2024-0448/): Elementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0447](https://insights.sbomify.com/CVE-2024-0447/): ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings Update (medium 5.0)
- [CVE-2024-0446](https://insights.sbomify.com/CVE-2024-0446/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-0445](https://insights.sbomify.com/CVE-2024-0445/): The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0444](https://insights.sbomify.com/CVE-2024-0444/): GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-0443](https://insights.sbomify.com/CVE-2024-0443/): Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline. (medium 5.5)
- [CVE-2024-0442](https://insights.sbomify.com/CVE-2024-0442/): Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0440](https://insights.sbomify.com/CVE-2024-0440/): SSRF - file:// unsanitized access to underlying host files (critical 9.6)
- [CVE-2024-0439](https://insights.sbomify.com/CVE-2024-0439/): User can manually send request at manager permission to modify system configurations (high 7.1)
- [CVE-2024-0438](https://insights.sbomify.com/CVE-2024-0438/): Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0437](https://insights.sbomify.com/CVE-2024-0437/): Missing authorization in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content (medium 4.3)
- [CVE-2024-0436](https://insights.sbomify.com/CVE-2024-0436/): Prevent timing attack for single-user password check (high 7.1)
- [CVE-2024-0435](https://insights.sbomify.com/CVE-2024-0435/): User can submit message to self-XSS (high 8.1)
- [CVE-2024-0434](https://insights.sbomify.com/CVE-2024-0434/): Missing authorization in Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution (medium 5.3)
- [CVE-2024-0433](https://insights.sbomify.com/CVE-2024-0433/): Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card (medium 4.3)
- [CVE-2024-0432](https://insights.sbomify.com/CVE-2024-0432/): Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_card (medium 4.3)
- [CVE-2024-0431](https://insights.sbomify.com/CVE-2024-0431/): Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_card (medium 4.3)
- [CVE-2024-0430](https://insights.sbomify.com/CVE-2024-0430/): IObit Malware Fighter v11.0.0.1274 - Denial of Service (DoS) (medium 5.5)
- [CVE-2024-0429](https://insights.sbomify.com/CVE-2024-0429/): Buffer overflow vulnerability on Hex Workshop (high 7.3)
- [CVE-2024-0428](https://insights.sbomify.com/CVE-2024-0428/): Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form (high 7.1)
- [CVE-2024-0427](https://insights.sbomify.com/CVE-2024-0427/): Arforms < 6.4.1 - Reflected XSS (medium 6.3)
- [CVE-2024-0426](https://insights.sbomify.com/CVE-2024-0426/): ForU CMS cms_template.php sql injection (medium 6.3)
- [CVE-2024-0425](https://insights.sbomify.com/CVE-2024-0425/): ForU CMS password recovery (medium 5.3)
- [CVE-2024-0424](https://insights.sbomify.com/CVE-2024-0424/): CodeAstro Simple Banking System Create a User Page createuser.php cross site scripting (low 3.5)
- [CVE-2024-0423](https://insights.sbomify.com/CVE-2024-0423/): CodeAstro Online Food Ordering System dishes.php cross site scripting (low 3.5)
- [CVE-2024-0422](https://insights.sbomify.com/CVE-2024-0422/): CodeAstro POS and Inventory Management System New Item Creation Page new_item cross site scripting (low 3.5)
- [CVE-2024-0421](https://insights.sbomify.com/CVE-2024-0421/): MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure (medium 5.3)
- [CVE-2024-0420](https://insights.sbomify.com/CVE-2024-0420/): MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-0419](https://insights.sbomify.com/CVE-2024-0419/): Jasper httpdx HTTP POST Request denial of service (medium 5.3)
- [CVE-2024-0418](https://insights.sbomify.com/CVE-2024-0418/): iSharer and upRedSun File Sharing Wizard GET Request denial of service (medium 5.3)
- [CVE-2024-0417](https://insights.sbomify.com/CVE-2024-0417/): DeShang DSShop MemberAuth.php path traversal (medium 5.4)
- [CVE-2024-0416](https://insights.sbomify.com/CVE-2024-0416/): DeShang DSMall MemberAuth.php path traversal (medium 5.4)
- [CVE-2024-0415](https://insights.sbomify.com/CVE-2024-0415/): DeShang DSMall Image URL TaobaoExport.php access control (medium 6.3)
- [CVE-2024-0414](https://insights.sbomify.com/CVE-2024-0414/): DeShang DSCMS install.php access control (medium 5.3)
- [CVE-2024-0413](https://insights.sbomify.com/CVE-2024-0413/): DeShang DSKMS install.php access control (medium 5.3)
- [CVE-2024-0412](https://insights.sbomify.com/CVE-2024-0412/): DeShang DSShop HTTP GET Request install.php access control (medium 5.3)
- [CVE-2024-0411](https://insights.sbomify.com/CVE-2024-0411/): DeShang DSMall HTTP GET Request install.php access control (medium 5.3)
- [CVE-2024-0410](https://insights.sbomify.com/CVE-2024-0410/): Improper Enforcement of Behavioral Workflow in GitLab (high 7.7)
- [CVE-2024-0409](https://insights.sbomify.com/CVE-2024-0409/): Xorg-x11-server: selinux context corruption (high 7.8)
- [CVE-2024-0408](https://insights.sbomify.com/CVE-2024-0408/): Xorg-x11-server: selinux unlabeled glx pbuffer (medium 5.5)
- [CVE-2024-0407](https://insights.sbomify.com/CVE-2024-0407/): Certain HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Information Disclosure (medium 6.5)
- [CVE-2024-0406](https://insights.sbomify.com/CVE-2024-0406/): Mholt/archiver: path traversal vulnerability (medium 6.1)
- [CVE-2024-0405](https://insights.sbomify.com/CVE-2024-0405/): Burst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL Injection (high 7.2)
- [CVE-2024-0404](https://insights.sbomify.com/CVE-2024-0404/): Mass Assignment Vulnerability in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2024-0403](https://insights.sbomify.com/CVE-2024-0403/): Recipes 1.5.10 - Blind SSRF (medium 6.5)
- [CVE-2024-0402](https://insights.sbomify.com/CVE-2024-0402/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (critical 9.9)
- [CVE-2024-0401](https://insights.sbomify.com/CVE-2024-0401/): ASUS OVPN RCE (high 7.2)
- [CVE-2024-0400](https://insights.sbomify.com/CVE-2024-0400/): Code injection in MACH SCM (high 7.5)
- [CVE-2024-0399](https://insights.sbomify.com/CVE-2024-0399/): WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection (high 8.1)
- [CVE-2024-0397](https://insights.sbomify.com/CVE-2024-0397/): Memory race condition in ssl.SSLContext certificate store methods (high 7.4)
- [CVE-2024-0396](https://insights.sbomify.com/CVE-2024-0396/): Missing Server-Side Input Validation in HTTP Parameter (high 7.1)
- [CVE-2024-0394](https://insights.sbomify.com/CVE-2024-0394/): Rapid7 Minerva Armor Privilege Escalation (high 7.8)
- [CVE-2024-0392](https://insights.sbomify.com/CVE-2024-0392/): Cross-site request forgery in WSO2 Enterprise Integrator (medium 5.4)
- [CVE-2024-0391](https://insights.sbomify.com/CVE-2024-0391/): Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery (medium 5.3)
- [CVE-2024-0390](https://insights.sbomify.com/CVE-2024-0390/): Hard-coded credentials in iZZi connect application (medium 6.2)
- [CVE-2024-0389](https://insights.sbomify.com/CVE-2024-0389/): SourceCodester Student Attendance System attendance_report.php sql injection (medium 6.3)
- [CVE-2024-0387](https://insights.sbomify.com/CVE-2024-0387/): EDS-4000/G4000 Series IP Forwarding Vulnerability (medium 6.5)
- [CVE-2024-0386](https://insights.sbomify.com/CVE-2024-0386/): weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer (high 7.2)
- [CVE-2024-0385](https://insights.sbomify.com/CVE-2024-0385/): Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory (medium 4.3)
- [CVE-2024-0384](https://insights.sbomify.com/CVE-2024-0384/): WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes (medium 6.4)
- [CVE-2024-0383](https://insights.sbomify.com/CVE-2024-0383/): WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag' (medium 6.4)
- [CVE-2024-0382](https://insights.sbomify.com/CVE-2024-0382/): WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag (medium 6.4)
- [CVE-2024-0381](https://insights.sbomify.com/CVE-2024-0381/): WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' (medium 6.4)
- [CVE-2024-0380](https://insights.sbomify.com/CVE-2024-0380/): WP Recipe Maker <= 9.1.0 - Directory Traversal (medium 5.4)
- [CVE-2024-0379](https://insights.sbomify.com/CVE-2024-0379/): Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update (medium 4.3)
- [CVE-2024-0378](https://insights.sbomify.com/CVE-2024-0378/): AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting (medium 6.5)
- [CVE-2024-0377](https://insights.sbomify.com/CVE-2024-0377/): LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/517/