CVE-2024-2564

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

CVE-2024-2564

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

CVE-2024-2564 PandaXGO PandaX user.go ExportUser path traversal

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

CVE-2024-2564

CVE-2024-2564 affects PandaXGO PandaX up to 20240310 . The vulnerability is in the function ExportUser (file /apps/system/api/user.go ); manipulating the filename parameter enables a path traversal (e.g., '../filedir'), potentially allowing access to files outside the intended directory. Exploita...

CVE-2024-2564 PandaXGO PandaX user.go ExportUser path traversal

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

CVE-2024-2562

A vulnerability, which was classified as critical, was found in PandaXGO PandaX up to 20240310. This affects the function InsertRole of the file /apps/system/services/rolemenu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-2563

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path...

CVE-2024-2562

A vulnerability, which was classified as critical, was found in PandaXGO PandaX up to 20240310. This affects the function InsertRole of the file /apps/system/services/rolemenu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-2563 PandaXGO PandaX upload.go DeleteImage path traversal

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path...

CVE-2024-2563

The CVE-2024-2563 entry concerns PandaXGO PandaX up to 20240310. A path traversal flaw exists in the DeleteImage function in /apps/system/router/upload.go, where an attacker can manipulate the fileName parameter (e.g., ../../../../../../../../../tmp/1.txt) to traverse to ../filedir. The issue is ...

CVE-2024-2563 PandaXGO PandaX upload.go DeleteImage path traversal

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path...

CVE-2024-2562 PandaXGO PandaX role_menu.go InsertRole sql injection

A vulnerability, which was classified as critical, was found in PandaXGO PandaX up to 20240310. This affects the function InsertRole of the file /apps/system/services/rolemenu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-2562 PandaXGO PandaX role_menu.go InsertRole sql injection

A vulnerability, which was classified as critical, was found in PandaXGO PandaX up to 20240310. This affects the function InsertRole of the file /apps/system/services/rolemenu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the attack remotely. The...

PT-2024-21060 · Unknown · Pandaxgo Pandax

Name of the Vulnerable Software and Affected Versions: PandaXGO PandaX up to 20240310 Description: A critical issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal, allowing an attacker to access files outside...

PT-2024-21065 · Unknown · Pandaxgo Pandax

Name of the Vulnerable Software and Affected Versions: PandaXGO PandaX up to 20240310 Description: A critical issue has been found in the File Extension Handler component, specifically in the /apps/system/router/upload.go file. The manipulation of the file argument leads to unrestricted upload...