PT-2024-2405 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 versions 15.03.05.18 through 15.03.20 multi Description: A critical vulnerability affects the formExpandDlnaFile function of the /goform/expandDlnaFile file, leading to a stack-based buffer overflow when the filePath argument is...

PT-2024-2380 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version 15.03.05.18 Description: The issue is related to insufficient authentication of requests executed by the fromSysToolReboot function, accessible through the "/goform/SysToolReboot" endpoint. This can be exploited by a remote...

PT-2024-20374 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: Jfinalcms version 5.0.0 Description: A SQL injection issue allows a remote attacker to obtain sensitive information. The issue is related to the /admin/admin API endpoint, specifically the name parameter. Recommendations: For Jfinalcms versio...

PT-2024-3068 · Unknown · Openmetadata

Name of the Vulnerable Software and Affected Versions: OpenMetadata versions prior to 1.2.4 Description: The issue is related to the AlertUtil::validateExpression method, which evaluates an SpEL expression using getValue with the StandardEvaluationContext, allowing interaction with Java classes...

PT-2024-20827 · Unknown · Online Medicine Ordering System

Name of the Vulnerable Software and Affected Versions: Online Medicine Ordering System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/omos/?p=products/view product" API endpoint. Recommendations: Fo...

PT-2024-20235 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions prior to 4.3.0-RC1 Description: A SQL injection issue exists, allowing an attacker to perform SQL injection by passing crafted offset, limit, and sort parameters via the "/common/dict/list" API endpoint. Recommendations: F...

PT-2024-15887 · Qwdigital · Qwdigital Linkwechat

Name of the Vulnerable Software and Affected Versions: qwdigital LinkWechat version 5.1.0 Description: A vulnerability was found in qwdigital LinkWechat, affecting an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation ...

PT-2024-2067 · Unknown · Gtb Central Console

Name of the Vulnerable Software and Affected Versions: GTB Central Console version 15.17.1-30814.NG Description: An issue was discovered in the GTB Central Console, where the method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerabl...

PT-2024-19500 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/system/score/scorerule save" API endpoint. Recommendations: For FlyCms version 1.0, as a temporary workaround, conside...

PT-2024-19450 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: A stored XSS issue exists via the "/gusetbook/save" API endpoint, specifically through the content parameter, allowing remote attackers to inject arbitrary web script or HTML. Recommendations: For JFinalcm...

PT-2024-15370 · Unknown · Huiran Host Reseller System

Name of the Vulnerable Software and Affected Versions: HuiRan Host Reseller System versions up to 2.0.0 Description: A vulnerability has been found in the HuiRan Host Reseller System, affecting an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler...

PT-2023-31591 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti version 1.2.25 Description: The issue is a Reflected Cross Site Scripting XSS vulnerability that allows remote attackers to escalate privileges. This occurs when an xml template file is uploaded via the "templates import.php" API...

PT-2023-31221 · Tenda · Tenda Ax9

Name of the Vulnerable Software and Affected Versions: Tenda AX9 version V22.03.01.46 Description: A command injection issue has been discovered in the mac parameter at the "/goform/SetOnlineDevName" API endpoint. This allows for potential command injection attacks. Recommendations: For Tenda AX9...

PT-2023-31186 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the /admin/slide/save API endpoint. Recommendations: For JFinalCMS version 5.0.0, update to a...

PT-2023-27703 · Unknown · Myprestamodules Ordersexport

Name of the Vulnerable Software and Affected Versions: MyPrestaModules ordersexport versions prior to 5.0 Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities are located at the send.php endpoint via the key and save setting parameters. Recommendations: Fo...

PT-2023-30668 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was found in Dreamer CMS. The issue is related to the "/admin/task/changeStatus" API endpoint. Recommendations: For Dreamer CMS version 4.1.3, as a temporary...

PT-2023-28812 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities are located at the /hoteldruid/clienti.php endpoint via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua...

PT-2023-28811 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A SQL injection vulnerability was discovered in Hoteldruid via the id utente log parameter at the "/hoteldruid/personalizza.php" API endpoint. This issue allows for potential SQL injection attacks...

PT-2023-27176 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel version 1.4.3 Description: 1Panel is an open source Linux server operation and maintenance management panel. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested...

PT-2023-26189 · Unknown · Bug Finder Chaincity Real Estate Investment Platform

Name of the Vulnerable Software and Affected Versions: Bug Finder ChainCity Real Estate Investment Platform version 1.0 Description: A problematic vulnerability has been found in the New Ticket Handler component of the Bug Finder ChainCity Real Estate Investment Platform. The issue affects an...