CVE-2024-4964

UNSUPPORTED WHEN ASSIGNED A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This vulnerability affects unknown code of the file /firewall/urlblist.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated...

CVE-2024-4904

A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument webimg leads to unrestricted upload. The attack may be initiated...

CVE-2024-4903 Tongda OA delete.php sql injection

A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/delete.php. The manipulation of the argument MIDSTR leads to sql injection. The attack can be initiated remotely. The exploit has been disclos...

CVE-2024-4820

CVE-2024-4820 affects SourceCodester Online Computer and Laptop Store 1.0. The vulnerability resides in the file /classes/SystemSettings.php?f=update_settings, allowing unrestricted (remote) upload. This has been publicly disclosed and is classified as high severity by NVD/CNA sources, with pract...

CVE-2024-4797

The CVE-2024-4797 affects Campcodes Online Laundry Management System 1.0. The vulnerability resides in the /ajax.php endpoint where the arguments name/customer_name/username can be manipulated to trigger cross-site scripting. Exploitation can be performed remotely, and public exploitation informa...

CVE-2024-4737 Campcodes Legal Case Management System vendor cross site scripting

A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vendor. The manipulation of the argument companyname/mobile leads to cross site scripting. It is possible to initiate the attack remotely...

CVE-2024-4731 Campcodes Legal Case Management System role cross site scripting

A vulnerability classified as problematic was found in Campcodes Legal Case Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/role. The manipulation of the argument slug leads to cross site scripting. The attack can be launched remotely. The...

CVE-2024-4729

CVE-2024-4729 affects Campcodes Legal Case Management System 1.0. The vulnerability is a cross-site scripting flaw caused by manipulation of the name argument in /admin/expense-type. It may be exploited remotely. Some sources indicate exploitation was disclosed. There is no vendor-provided patch ...

CVE-2024-4718

CVE-2024-4718 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerable component is an unknown function in /model/delete_student_grade_subject.php, where manipulation of the index parameter enables cross-site scripting. Exploitation can be performed remotely, and public d...

CVE-2024-4674

CVE-2024-4674 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability resides in the /view/show_friend_request.php page, where unsafely handling the my_index parameter enables cross-site scripting. The issue can be triggered remotely and exploit details have been publ...

CVE-2024-4644

CVE-2024-4644 affects SourceCodester Prison Management System 1.0, with a cross-site scripting flaw in the code path that handles /Employee/changepassword.php. The vulnerability allows manipulation of the txtold_password, txtnew_password, and txtconfirm_password fields to trigger XSS. Publicly di...

CVE-2024-4587

A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be use...

CVE-2024-4584

A vulnerability, which was classified as problematic, has been found in Faraday GM8181 and GM828x up to 20240429. Affected by this issue is some unknown functionality of the file /commandport.ini. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit h...

CVE-2024-4507

A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6StaticRoute/staticrouteaddipv6.php. The manipulation of the argument textprefixlen/textgateway/devname leads to os command injection. The...

CVE-2024-4507 Ruijie RG-UAC static_route_add_ipv6.php os command injection

A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6StaticRoute/staticrouteaddipv6.php. The manipulation of the argument textprefixlen/textgateway/devname leads to os command injection. The...

CVE-2024-4507

CVE-2024-4507 affects Ruijie RG-UAC (up to 20240428). The issue is an OS command injection in the web interface, triggered by manipulating parameters text_prefixlen, text_gateway, or devname in the PHP path /view/IPV6/ipv6StaticRoute/static_route_add_ipv6.php. Impact per sources: remote attacker ...

image-optimizer allows PHAR deserialization

image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to fileexists...

CVE-2023-47727 IBM QRadar Suite Software file manipulation

IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation. IBM X-Force ID: 272089...

CVE-2023-47727 IBM QRadar Suite Software file manipulation

IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation. IBM X-Force ID: 272089...

CVE-2024-4172 idcCMS cross-site request forgery

A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /admin/admincl.php?mudi=revPwd. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to t...