# Vulnerabilities published in 2024


- [CVE-2024-0376](https://insights.sbomify.com/CVE-2024-0376/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-0374](https://insights.sbomify.com/CVE-2024-0374/): Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view (medium 4.3)
- [CVE-2024-0373](https://insights.sbomify.com/CVE-2024-0373/): Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view (medium 4.3)
- [CVE-2024-0372](https://insights.sbomify.com/CVE-2024-0372/): Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields (medium 4.3)
- [CVE-2024-0371](https://insights.sbomify.com/CVE-2024-0371/): Views for WPForms <= 3.2.2 - Missing Authorization via create_view (medium 4.3)
- [CVE-2024-0370](https://insights.sbomify.com/CVE-2024-0370/): Views for WPForms <= 3.2.2 - Missing Authorization via save_view (medium 4.3)
- [CVE-2024-0369](https://insights.sbomify.com/CVE-2024-0369/): Bulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitles (medium 4.3)
- [CVE-2024-0368](https://insights.sbomify.com/CVE-2024-0368/): Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys (high 8.6)
- [CVE-2024-0367](https://insights.sbomify.com/CVE-2024-0367/): Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link (medium 6.4)
- [CVE-2024-0366](https://insights.sbomify.com/CVE-2024-0366/): Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference (medium 4.3)
- [CVE-2024-0365](https://insights.sbomify.com/CVE-2024-0365/): Fancy Product Designer < 6.1.5 - Admin+ SQL Injection (medium 6.5)
- [CVE-2024-0364](https://insights.sbomify.com/CVE-2024-0364/): PHPGurukul Hospital Management System query-details.php sql injection (medium 5.5)
- [CVE-2024-0363](https://insights.sbomify.com/CVE-2024-0363/): PHPGurukul Hospital Management System patient-search.php sql injection (medium 5.5)
- [CVE-2024-0362](https://insights.sbomify.com/CVE-2024-0362/): PHPGurukul Hospital Management System change-password.php sql injection (medium 5.5)
- [CVE-2024-0361](https://insights.sbomify.com/CVE-2024-0361/): PHPGurukul Hospital Management System contact.php sql injection (medium 5.5)
- [CVE-2024-0360](https://insights.sbomify.com/CVE-2024-0360/): PHPGurukul Hospital Management System edit-doctor-specialization.php sql injection (medium 5.5)
- [CVE-2024-0359](https://insights.sbomify.com/CVE-2024-0359/): code-projects Simple Online Hotel Reservation System login.php sql injection (high 7.3)
- [CVE-2024-0358](https://insights.sbomify.com/CVE-2024-0358/): DeShang DSO2O install.php access control (medium 5.3)
- [CVE-2024-0357](https://insights.sbomify.com/CVE-2024-0357/): coderd-repos Eva HTTP POST Request page sql injection (medium 5.5)
- [CVE-2024-0356](https://insights.sbomify.com/CVE-2024-0356/): Mandelo ssm_shiro_blog Backend updateRoles access control (medium 4.3)
- [CVE-2024-0355](https://insights.sbomify.com/CVE-2024-0355/): PHPGurukul Dairy Farm Shop Management System add-category.php sql injection (medium 5.5)
- [CVE-2024-0354](https://insights.sbomify.com/CVE-2024-0354/): unknown-o download-station index.php path traversal (medium 5.3)
- [CVE-2024-0353](https://insights.sbomify.com/CVE-2024-0353/): Local privilege escalation in Windows products (high 7.8)
- [CVE-2024-0352](https://insights.sbomify.com/CVE-2024-0352/): Likeshop HTTP POST Request File.php userFormImage unrestricted upload (high 7.3)
- [CVE-2024-0351](https://insights.sbomify.com/CVE-2024-0351/): SourceCodester Engineers Online Portal session fixiation (low 3.1)
- [CVE-2024-0350](https://insights.sbomify.com/CVE-2024-0350/): SourceCodester Engineers Online Portal session expiration (low 3.1)
- [CVE-2024-0349](https://insights.sbomify.com/CVE-2024-0349/): SourceCodester Engineers Online Portal missing secure attribute (low 3.7)
- [CVE-2024-0348](https://insights.sbomify.com/CVE-2024-0348/): SourceCodester Engineers Online Portal File Upload resource consumption (medium 4.3)
- [CVE-2024-0347](https://insights.sbomify.com/CVE-2024-0347/): SourceCodester Engineers Online Portal signup_teacher.php weak password (low 3.7)
- [CVE-2024-0346](https://insights.sbomify.com/CVE-2024-0346/): CodeAstro Vehicle Booking System Feedback Page user-give-feedback.php cross site scripting (low 3.5)
- [CVE-2024-0345](https://insights.sbomify.com/CVE-2024-0345/): CodeAstro Vehicle Booking System User Registration usr-register.php cross site scripting (medium 4.3)
- [CVE-2024-0344](https://insights.sbomify.com/CVE-2024-0344/): soxft TimeMail check.php sql injection (medium 5.5)
- [CVE-2024-0343](https://insights.sbomify.com/CVE-2024-0343/): CodeAstro Simple House Rental System Login Panel cross site scripting (medium 4.3)
- [CVE-2024-0342](https://insights.sbomify.com/CVE-2024-0342/): Inis Sqlite.php sql injection (medium 6.3)
- [CVE-2024-0341](https://insights.sbomify.com/CVE-2024-0341/): Inis GET Request File.php path traversal (low 3.5)
- [CVE-2024-0340](https://insights.sbomify.com/CVE-2024-0340/): Kernel: information disclosure in vhost/vhost.c:vhost_new_msg() (medium 4.4)
- [CVE-2024-0338](https://insights.sbomify.com/CVE-2024-0338/): Buffer Overflow Vulnerability in XAMPP (high 7.3)
- [CVE-2024-0337](https://insights.sbomify.com/CVE-2024-0337/): Travelpayouts <= 1.1.15 - Open Redirect (medium 6.1)
- [CVE-2024-0336](https://insights.sbomify.com/CVE-2024-0336/): Improper Access Control in EMTA Grups PDKS (critical 9.4)
- [CVE-2024-0335](https://insights.sbomify.com/CVE-2024-0335/): Malformed Packet Handling (high 7.5)
- [CVE-2024-0334](https://insights.sbomify.com/CVE-2024-0334/): Cross-site scripting in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (medium 6.4)
- [CVE-2024-0333](https://insights.sbomify.com/CVE-2024-0333/): Security feature bypass in Chrome (medium 5.3)
- [CVE-2024-0326](https://insights.sbomify.com/CVE-2024-0326/): Premium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper (medium 6.4)
- [CVE-2024-0325](https://insights.sbomify.com/CVE-2024-0325/): Command Injection in Helix Sync (low 3.6)
- [CVE-2024-0324](https://insights.sbomify.com/CVE-2024-0324/): Missing authorization in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (high 8.2)
- [CVE-2024-0323](https://insights.sbomify.com/CVE-2024-0323/): FTP uses unsecure encryption mechanisms (critical 9.8)
- [CVE-2024-0322](https://insights.sbomify.com/CVE-2024-0322/): Out-of-bounds Read in gpac/gpac (medium 4.4)
- [CVE-2024-0321](https://insights.sbomify.com/CVE-2024-0321/): Stack-based Buffer Overflow in gpac/gpac (medium 4.0)
- [CVE-2024-0320](https://insights.sbomify.com/CVE-2024-0320/): Cross-Site Scripting in FireEye Malware Analysis (AX) (medium 5.4)
- [CVE-2024-0319](https://insights.sbomify.com/CVE-2024-0319/): Open Redirect vulnerability in FireEye HXTool (medium 5.4)
- [CVE-2024-0318](https://insights.sbomify.com/CVE-2024-0318/): Cross-Site Scripting in FireEye HXTool (medium 5.4)
- [CVE-2024-0317](https://insights.sbomify.com/CVE-2024-0317/): Cross-Site Scripting in FireEye EX (medium 5.4)
- [CVE-2024-0316](https://insights.sbomify.com/CVE-2024-0316/): Improper cleanup vulnerability in FireEye Endpoint Security (medium 6.8)
- [CVE-2024-0315](https://insights.sbomify.com/CVE-2024-0315/): Remote file inclusion vulnerability in FireEye Central Management (medium 6.6)
- [CVE-2024-0314](https://insights.sbomify.com/CVE-2024-0314/): XSS vulnerability in FireEye Central Management (medium 5.4)
- [CVE-2024-0313](https://insights.sbomify.com/CVE-2024-0313/): Security feature bypass in Skyhigh Client Proxy (medium 5.5)
- [CVE-2024-0312](https://insights.sbomify.com/CVE-2024-0312/): Security feature bypass in Skyhigh Client Proxy (medium 5.5)
- [CVE-2024-0311](https://insights.sbomify.com/CVE-2024-0311/): Security feature bypass in Skyhigh Client Proxy (medium 5.5)
- [CVE-2024-0310](https://insights.sbomify.com/CVE-2024-0310/): Security feature bypass in Trellix Endpoint Security (ENS) Web Control (medium 6.1)
- [CVE-2024-0308](https://insights.sbomify.com/CVE-2024-0308/): Inis Proxy.php server-side request forgery (medium 6.3)
- [CVE-2024-0307](https://insights.sbomify.com/CVE-2024-0307/): Kashipara Dynamic Lab Management System login_process.php sql injection (high 7.3)
- [CVE-2024-0306](https://insights.sbomify.com/CVE-2024-0306/): Kashipara Dynamic Lab Management System admin_login_process.php sql injection (high 7.3)
- [CVE-2024-0305](https://insights.sbomify.com/CVE-2024-0305/): Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure (medium 5.3)
- [CVE-2024-0304](https://insights.sbomify.com/CVE-2024-0304/): Youke365 collect.php server-side request forgery (medium 6.3)
- [CVE-2024-0303](https://insights.sbomify.com/CVE-2024-0303/): Youke365 Parameter caiji.php server-side request forgery (medium 6.3)
- [CVE-2024-0302](https://insights.sbomify.com/CVE-2024-0302/): fhs-opensource iparking vueLogin deserialization (medium 6.3)
- [CVE-2024-0301](https://insights.sbomify.com/CVE-2024-0301/): fhs-opensource iparking PayTempOrderAction.java getData sql injection (medium 6.3)
- [CVE-2024-0300](https://insights.sbomify.com/CVE-2024-0300/): Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload (medium 6.3)
- [CVE-2024-0299](https://insights.sbomify.com/CVE-2024-0299/): Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection (high 7.3)
- [CVE-2024-0298](https://insights.sbomify.com/CVE-2024-0298/): Totolink N200RE cstecgi.cgi setDiagnosisCfg os command injection (high 7.3)
- [CVE-2024-0297](https://insights.sbomify.com/CVE-2024-0297/): Totolink N200RE cstecgi.cgi UploadFirmwareFile os command injection (high 7.3)
- [CVE-2024-0296](https://insights.sbomify.com/CVE-2024-0296/): Totolink N200RE cstecgi.cgi NTPSyncWithHost os command injection (high 7.3)
- [CVE-2024-0295](https://insights.sbomify.com/CVE-2024-0295/): Totolink LR1200GB cstecgi.cgi setWanCfg os command injection (high 7.3)
- [CVE-2024-0294](https://insights.sbomify.com/CVE-2024-0294/): Totolink LR1200GB cstecgi.cgi setUssd os command injection (high 7.3)
- [CVE-2024-0293](https://insights.sbomify.com/CVE-2024-0293/): Totolink LR1200GB cstecgi.cgi setUploadSetting os command injection (medium 6.3)
- [CVE-2024-0292](https://insights.sbomify.com/CVE-2024-0292/): Totolink LR1200GB cstecgi.cgi setOpModeCfg os command injection (medium 6.3)
- [CVE-2024-0291](https://insights.sbomify.com/CVE-2024-0291/): Totolink LR1200GB cstecgi.cgi UploadFirmwareFile command injection (medium 6.3)
- [CVE-2024-0290](https://insights.sbomify.com/CVE-2024-0290/): Kashipara Food Management System stock_edit.php sql injection (medium 6.3)
- [CVE-2024-0289](https://insights.sbomify.com/CVE-2024-0289/): Kashipara Food Management System stock_entry_submit.php sql injection (medium 6.3)
- [CVE-2024-0288](https://insights.sbomify.com/CVE-2024-0288/): Kashipara Food Management System rawstock_used_damaged_submit.php sql injection (medium 6.3)
- [CVE-2024-0287](https://insights.sbomify.com/CVE-2024-0287/): Kashipara Food Management System itemBillPdf.php sql injection (medium 6.3)
- [CVE-2024-0286](https://insights.sbomify.com/CVE-2024-0286/): PHPGurukul Hospital Management System Contact Form index.php#contact_us cross site scripting (medium 4.3)
- [CVE-2024-0285](https://insights.sbomify.com/CVE-2024-0285/): Dsoftbus has an improper input validation vulnerability (medium 4.7)
- [CVE-2024-0284](https://insights.sbomify.com/CVE-2024-0284/): Kashipara Food Management System party_submit.php cross site scripting (low 3.5)
- [CVE-2024-0283](https://insights.sbomify.com/CVE-2024-0283/): Kashipara Food Management System party_details.php cross site scripting (low 3.5)
- [CVE-2024-0282](https://insights.sbomify.com/CVE-2024-0282/): Kashipara Food Management System addmaterialsubmit.php cross site scripting (low 3.5)
- [CVE-2024-0281](https://insights.sbomify.com/CVE-2024-0281/): Kashipara Food Management System loginCheck.php sql injection (medium 6.3)
- [CVE-2024-0280](https://insights.sbomify.com/CVE-2024-0280/): Kashipara Food Management System item_type_submit.php sql injection (medium 6.3)
- [CVE-2024-0279](https://insights.sbomify.com/CVE-2024-0279/): Kashipara Food Management System item_list_edit.php sql injection (medium 6.3)
- [CVE-2024-0278](https://insights.sbomify.com/CVE-2024-0278/): Kashipara Food Management System partylist_edit_submit.php sql injection (medium 6.3)
- [CVE-2024-0277](https://insights.sbomify.com/CVE-2024-0277/): Kashipara Food Management System party_submit.php sql injection (medium 6.3)
- [CVE-2024-0276](https://insights.sbomify.com/CVE-2024-0276/): Kashipara Food Management System rawstock_used_damaged_smt.php sql injection (medium 6.3)
- [CVE-2024-0275](https://insights.sbomify.com/CVE-2024-0275/): Kashipara Food Management System item_edit_submit.php sql injection (medium 6.3)
- [CVE-2024-0274](https://insights.sbomify.com/CVE-2024-0274/): Kashipara Food Management System billAjax.php sql injection (medium 6.3)
- [CVE-2024-0273](https://insights.sbomify.com/CVE-2024-0273/): Kashipara Food Management System addwaste_entry.php sql injection (medium 6.3)
- [CVE-2024-0272](https://insights.sbomify.com/CVE-2024-0272/): Kashipara Food Management System addmaterialsubmit.php sql injection (medium 6.3)
- [CVE-2024-0271](https://insights.sbomify.com/CVE-2024-0271/): Kashipara Food Management System addmaterial_edit.php sql injection (medium 6.3)
- [CVE-2024-0270](https://insights.sbomify.com/CVE-2024-0270/): Kashipara Food Management System item_list_submit.php sql injection (medium 6.3)
- [CVE-2024-0269](https://insights.sbomify.com/CVE-2024-0269/): SQL Injection (high 8.3)
- [CVE-2024-0268](https://insights.sbomify.com/CVE-2024-0268/): Kashipara Hospital Management System registration.php sql injection (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/518/