CVE-2024-3322

The CVE-2024-3322 path-traversal vulnerability affects parisneo/lollms-webui “cyber_security/codeguard” native personality up to version 9.5. The root cause is improper sanitization of user-supplied code_folder_path in lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor...

CVE-2024-3322 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the 'cybersecurity/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'processfolder' function within...

CVE-2024-3322 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the 'cybersecurity/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'processfolder' function within...

CVE-2024-3152

The CVE-2024-3152 entry for mintplex-labs/anything-llm has concrete technical details in the connected records: multiple endpoints suffer from improper input validation passed to Prisma and other critical operations, enabling privilege escalation from a default user to admin, read/delete of arbit...

CVE-2024-3152 Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform...

qdrant input validation failure

qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the...

CVE-2024-5587

A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the component Configuration File Handler. The manipulation leads to files or directories accessible. It is possible to launch the attack remotel...

CVE-2024-35358

A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=viewcategory. Manipulating the argument id can result in SQL injection...

CVE-2024-35219

A flaw was found in OpenAPI generator, where it allows the generation of API client libraries, for example, SDK generation, server stubs, documentation, and configuration, automatically given an OpenAPI Spec. This flaw allows an attacker to cause a path traversal vulnerability to read and delete...

CVE-2024-5395

A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file listofinstructor.php. The manipulation of the argument FullName leads to sql injection. The attack may be initiated remotely. The...

CVE-2024-5395 itsourcecode Online Student Enrollment System listofinstructor.php sql injection

A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file listofinstructor.php. The manipulation of the argument FullName leads to sql injection. The attack may be initiated remotely. The...

CVE-2024-5383

A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The manipulation of the argument file leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2024-5379

CVE-2024-5379 is a cross-site scripting (XSS) vulnerability affecting JFinalCMS up to 20240111. The issue arises from manipulating the directory argument of the file under /admin/template , leading to XSS. The vulnerability can be exploited remotely and the exploit has been publicly disclosed. Mu...

CVE-2024-5371

A vulnerability classified as problematic has been found in Kashipara College Management System 1.0. This affects an unknown part of the file submitenrollstudent.php. The manipulation of the argument classname leads to cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2024-5359

CVE-2024-5359 affects PHPGurukul Zoo Management System v2.1, with a SQL injection in /admin/foreigner-search.php via the searchdata parameter. Exploitation appears remote and publicly disclosed. Connected sources corroborate the file and parameter as the entry point; no official patch/version det...

CVE-2024-5338

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been classified as critical. Affected is an unknown function of the file /view/vpn/autovpn/online.php. The manipulation of the argument peernode leads to os command injection. It is possible to launch the attack remotely. The explo...

CVE-2024-5310

A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to th...

CVE-2024-5135 PHPGurukul Directory Management System index.php sql injection

A vulnerability was found in PHPGurukul Directory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has...

CVE-2024-5050 Wangshen SecGate 3600 ?g=log_import_save unrestricted upload

A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=logimportsave. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The associated...

CVE-2024-4966

A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...