CVE-2024-30926

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component...

CVE-2024-30920

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...

CVE-2024-30922

SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering...

CVE-2024-30927

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component...

DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet . /inc/kiosks.inc script suffers from a cross-site scripting vulnerability that can be exploited by an attacker to steal a victim's cookie-based authentication credentials...

CVE-2024-30929

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php...

CVE-2024-30928

DerbyNet v9.0 and below contains a SQL injection in the ajax/query.slide.next.inc endpoint via the unvalidated classids parameter. The issue allows remote attackers to execute arbitrary SQL commands, enabling viewing, adding, modifying, or deleting data in the back-end database. Documents consist...

CVE-2024-30923

SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering...

CVE-2024-30923

DerbyNet v9.0 and earlier versions are affected by an SQL Injection in the print/render/racer.inc path that allows remote code execution via the where clause in Racer Document Rendering. Root cause is insufficient sanitization of the where parameter, enabling attackers to manipulate SQL queries. ...

DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet photo.php script due to improper validation of user-supplied input in the photo.php script. An attacker could use this vulnerability to steal the victim's cookie-based...

CVE-2024-30921

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component...

CVE-2024-30928

SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc...

CVE-2024-30928

SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc...

CVE-2024-30926

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component...

PT-2024-23676 · Derbynet · Derbynet

Name of the Vulnerable Software and Affected Versions: DerbyNet versions 9.0 and below Description: The issue allows attackers to execute arbitrary code via the ./inc/kiosks.inc component. This is a Cross Site Scripting vulnerability. Recommendations: For DerbyNet versions 9.0 and below, consider...

DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A security vulnerability exists in DerbyNet version v9.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the where clause in the Racer document rendering...

CVE-2024-30921

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component...

DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet racerid parameter due to improper validation of user-supplied input in the photo-thumbs.php script. An attacker could use this vulnerability to steal the victim's cookie-based...

CVE-2024-30929

CVE-2024-30929 affects DerbyNet v9.0 and earlier; the vulnerability is a cross-site scripting flaw in the playlist.php back parameter that can lead to arbitrary code execution. The CVSS 3.1 base score is 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C/H/I/H/A:H). Affected product/versions: DerbyNet 9.0 and below....

CVE-2024-30925

Summary (CVE-2024-30925): DerbyNet versions 9.0 and below contain a Cross Site Scripting vulnerability in the photo-thumbs.php component that can lead to arbitrary code execution. The issue stems from insufficient input handling for certain parameters (notably racerid and back) used to generate n...