CVE-2024-33118

LuckyFrameWeb version v3.5.2 contains an arbitrary read vulnerability located in the fileDownload method within the com.luckyframe.project.common.CommonController class. This flaw allows for unauthorized reading of data. As a temporary workaround, it is recommended to disable the fileDownload met...

CVE-2024-33118: Download of Code Without Integrity Check

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController...

CVE-2024-33118

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController...

CVE-2024-33118

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController...

PT-2024-25120 · Unknown · Luckyframeweb

Name of the Vulnerable Software and Affected Versions: LuckyFrameWeb version 3.5.2 Description: The issue is related to an arbitrary read vulnerability. It affects the fileDownload method in the class com.luckyframe.project.common.CommonController. Recommendations: For LuckyFrameWeb version 3.5.2...

CVE-2023-24221

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml...

CVE-2023-24220

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

CVE-2023-24219

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml...

Sql injection

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

Sql injection

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml...

Sql injection

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml...

CVE-2023-24221: Improper Neutralization of Special Elements used in an SQL Command

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml...

CVE-2023-24221

Affected product: LuckyframeWEB v3.5. Vulnerability: SQL injection via the dataScope parameter in /system/DeptMapper.xml. Root cause: unsanitized input leading to query manipulation (as stated in CVE records). Impact: high confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Ex...

CVE-2023-24220

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

CVE-2023-24219

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml...

CVE-2023-24221

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml...

CVE-2023-24221

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml...

CVE-2023-24220

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

PT-2023-19485

Name of the Vulnerable Software and Affected Versions LuckyframeWEB version 3.5 Description A SQL injection issue was found in LuckyframeWEB via the dataScope parameter at the "/system/DeptMapper.xml" API endpoint. This allows for potential SQL injection attacks. Recommendations For LuckyframeWEB...

CVE-2023-24220: Improper Neutralization of Special Elements used in an SQL Command

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...