CVE-2024-39701

Directus is a real-time API and App dashboard for managing SQL database content. Directus =9.23.0, =v10.5.3 improperly handles in, nin operators. It evaluates empty arrays as valid so expressions like "role": "in": $CURRENTUSER.somefield would evaluate to true allowing the request to pass. This...

CVE-2024-39701: Improper Access Control

Directus is a real-time API and App dashboard for managing SQL database content. Directus =9.23.0, =v10.5.3 improperly handles in, nin operators. It evaluates empty arrays as valid so expressions like "role": "in": $CURRENTUSER.somefield would evaluate to true allowing the request to pass. This...

SQL Injection Vulnerability in MetInfo ot***_in***.php Page

MetInfo is an enterprise website management system with PHP+Mysql architecture. A SQL injection vulnerability exists in the MetInfo otin.php page, which can be exploited by an attacker to obtain sensitive information from the database...

Stored cross-site scripting vulnerability in DedeCMS ed***_sp***_in***.php page

Dream Content Management System DedeCMS is a PHP open source website management system. A stored cross-site scripting vulnerability exists in the DedeCMS edspin.php page. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...