CVE-2024-57767

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery SSRF via the component /file/download...

CVE-2024-57764

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add...

CVE-2024-57767

MSFM (a permissions management system) versions prior to v2025.01.01 are vulnerable to a Server-Side Request Forgery (SSRF) via the /file/download component. This vulnerability allows an attacker to gain unauthorized access to internal resources. To mitigate the risk, it is recommended to disable...

PT-2025-3561 · Msfm · Msfm

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to v2025.01.01 Description: The issue is related to a Server-Side Request Forgery SSRF in MSFM, which occurs via the /file/download component. This allows for unauthorized access to internal resources. Recommendations: For...

CVE-2024-57762

MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file...

CVE-2024-57763

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField...

PT-2025-3557 · Msfm +1 · Msfm +1

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to 2025.01.01 Description: The issue is related to a fastjson deserialization vulnerability in the component system/table/addField. This vulnerability was discovered in MSFM. Recommendations: For versions prior to...

CVE-2024-57765

The permission management system Mysiteforme (MSFM) is vulnerable to SQL injection in versions prior to 2025.01.01 . The flaw exists because the application fails to properly validate the s_name parameter at the table/list endpoint, allowing attackers to execute unauthorized SQL commands and pote...