CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

14Finger Security Vulnerability

14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in version 1.1 of 14Finger, which stems from a vulnerability that allows an attacker to elevate privileges from a regular user to an administrator via a...

PT-2024-27740 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the software allow attackers to escalate privileges from a normal user to Administrator via a crafted POST request. This issue can be exploited by sending a manipulated POST request to...

CVE-2024-39211

Kaiten 57.128.8 (workflow management system) is affected by CVE-2024-39211. A crafted POST request to the login endpoint can cause information leakage because the login response reveals a user_email field only when the target user exists, enabling remote attackers to enumerate user accounts. This...

CVE-2024-39211

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...

CVE-2024-39211

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...

The vulnerability of the setwirelessrepeat function (/goform/WifiExtraSet) in the Tenda A301 router software allows a hacker to cause a service failure.

The vulnerability of the setwirelessrepeat /goform/WifiExtraSet function in the Tenda A301 router software lies in buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure through the wpapskcrypto parameter using a specially crafted POST...

CVE-2024-39243

An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editorsave...

CVE-2024-37734

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter...

CVE-2024-39243

CVE-2024-39243 affects skycaiji 2.8. An attacker can execute arbitrary code via a crafted POST request to /index.php?s=/admin/develop/editor_save. The connected sources (Red Hat, NVD, CVE listings, CNNVD, OSV, CVE community listings) corroborate the same vector; no vendor-confirmed patch or fixed...

CVE-2024-37734

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter...

CVE-2024-4748 RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

CVE-2024-4748 RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

PT-2024-32629 · Cruddiy · Cruddiy

Name of the Vulnerable Software and Affected Versions: CRUDDIY affected versions not specified Description: The issue allows for shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally...

CVE-2024-37665

An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...

CVE-2024-37665

An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...

PT-2024-27704 · Unknown · Wvp Gb28181 Pro

Name of the Vulnerable Software and Affected Versions: Wvp GB28181 Pro version 2.0 Description: An access control issue allows authenticated attackers to escalate privileges to Administrator via a crafted POST request. Recommendations: For Wvp GB28181 Pro version 2.0, consider restricting access ...