CVE-2022-24239

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...

CVE-2022-24240

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

CVE-2022-24241

ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...

CVE-2022-24238

ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting XSS vulnerability via the txtNmName1 parameter in person.awp...

Cross site scripting

ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting XSS vulnerability via the txtNmName1 parameter in person.awp...

Unrestricted file upload

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...

Path traversal

ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...

Sql injection

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

Design/Logic Flaw

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...

ACEware Systems ACEweb Online Portal 跨站脚本漏洞

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A cross-site scripting vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which originates in person. The txtNmName1 parameter in awp lacks a validation filter...

ACEware Systems ACEweb Online Portal 代码问题漏洞

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems. A security vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065. An attacker has exploited this vulnerability to create an unrestricted file upload vulnerability via...

ACEware Systems ACEweb Online Portal 安全漏洞

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A security vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from the discovery that ACEweb Online Portal 3.5.065 contains an external controlled...

ACEware Systems ACEweb Online Portal SQL注入漏洞

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A SQL injection vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from The conditional parameter in showchedule.awp lacks validation for external...

ACEware Systems ACEweb Online Portal 代码问题漏洞

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems. A security vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065. An attacker could use this vulnerability to trick a vulnerable server into disclosing the username and...

CVE-2022-24581: Unrestricted Upload of File with Dangerous Type

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...

CVE-2022-24241: Externally Controlled Reference to a Resource in Another Sphere

ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...

CVE-2022-24239: Unrestricted Upload of File with Dangerous Type

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...

CVE-2022-24238: Improper Neutralization of Input During Web Page Generation

ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting XSS vulnerability via the txtNmName1 parameter in person.awp...

CVE-2022-24240: Improper Neutralization of Special Elements used in an SQL Command

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

CVE-2022-24581

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...