CVE-2024-30928

A SQL Injection vulnerability exists in DerbyNet v9.0 and below . Attackers can execute arbitrary SQL commands by exploiting the 'classids' parameter within the ajax/query.slide.next.inc endpoint. This vulnerability allows for the unauthorized viewing, addition, modification, or deletion of infor...

CVE-2024-30927

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component...

CVE-2024-30924

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component...

CVE-2024-30926

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component...

CVE-2024-30925

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component...

CVE-2024-30921: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component...

CVE-2024-30922

SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering...

CVE-2024-30921

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component...

CVE-2024-30928

SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc...

CVE-2024-30923

SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering...

CVE-2024-30925

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component...

CVE-2024-30922

SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering...

CVE-2024-30929

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php...

CVE-2024-30922

SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering...

CVE-2024-31818

Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component...

CVE-2024-31818

Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component...

PT-2024-24226 · Derbynet · Derbynet

Name of the Vulnerable Software and Affected Versions: DerbyNet version 9.0 Description: A Directory Traversal issue allows a remote attacker to execute arbitrary code via the page parameter of the "kiosk.php" component. Recommendations: For DerbyNet version 9.0, consider restricting access to th...

CVE-2024-31818

Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component...

CVE-2024-31818

A Directory Traversal vulnerability exists in DerbyNet v.9.0 within the kiosk.php component. A remote attacker can exploit the page parameter to achieve arbitrary code execution . To mitigate this risk, it is recommended to restrict access to the kiosk.php component or avoid using the page parame...

CVE-2024-31818: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component...