CVE-2024-7184

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely...

CVE-2024-7183 TOTOLINK A3600R cstecgi.cgi setUploadSetting buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. Affected is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. It is possible to launch the attack remotely. The...

CVE-2024-7161

A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=chgpwdsubmit of the component Password Change Handler. The manipulation of the argument newpwd/newpwd2 leads to cross-site request forgery...

CVE-2024-7160

The CVE-2024-7160 entry concerns TOTOLINK A3700R (version 9.1.2u.5822_B20200513). Affects the function setWanCfg in /cgi-bin/cstecgi.cgi; manipulating the hostName parameter leads to command injection. Exploitation is described as remote with public disclosure. Multiple connected references corro...

CVE-2024-7154

The CVE-2024-7154 entry applies to TOTOLINK A3700R with version 9.1.2u.5822_B20200513. Affected is an unknown function in /wizard.html of the Password Reset Handler. The root cause is improper access controls, enabling remote exploitation. Multiple connected sources corroborate this (e.g., Red Ha...

CVE-2024-7151 Tenda O3 setMacFilter fromMacFilterSet stack-based overflow

A vulnerability was found in Tenda O3 1.0.0.102478. It has been declared as critical. This vulnerability affects the function fromMacFilterSet of the file /goform/setMacFilter. The manipulation of the argument remark leads to stack-based buffer overflow. The attack can be initiated remotely. The...

CVE-2024-7120

The CVE-2024-7120 entry concerns Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 devices (Web Interface, file list_base_config.php). The root cause is improper handling of the template argument, enabling OS command injection with remote access. Impact is remote code execution and potential full control...

Cross-Site Request Forgery in Spina

A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/mediafolders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2024-7080 SourceCodester Insurance Management System direct request

A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /E-Insurance/. The manipulation leads to direct request. The attack can be launched remotely. The exploit has be...

CVE-2024-6962

A vulnerability classified as critical was found in Tenda O3 1.0.0.10. This vulnerability affects the function formQosSet. The manipulation of the argument remark/ipRange/upSpeed/downSpeed/enable leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been...

CVE-2024-6963 Tenda O3 formexeCommand stack-based overflow

A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. This issue affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the publi...

CVE-2024-6951

The CVE-2024-6951 entry corresponds to a SQL injection in SourceCodester Simple Online Book Store System 1.0,具体 affecting the admin_delete.php logic where the bookisbn parameter is manipulated. Exploitation can be performed remotely and has been disclosed publicly, with multiple sources assigning...

CVE-2024-6946 Flute CMS list code injection

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been declared as critical. This vulnerability affects unknown code of the file /admin/pages/list. The manipulation of the argument blocks leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2024-6935

Form Tools 3.1.1 is affected by a cross-site scripting vulnerability in the User Settings Page, specifically the /admin/clients/ file. The issue is triggered remotely and has publicly disclosed exploit details. Affected component/URL: /admin/clients/ within Form Tools 3.1.1. Root cause and exact ...

CVE-2024-6903

CVE-2024-6903 affects SourceCodester Record Management System 1.0, with a vulnerability in the file sort1_user.php where manipulating the position argument enables SQL injection. The issue is exploitable remotely, and multiple sources indicate an active exploit/disclosure. Root cause: improper ha...

CVE-2024-6523 ZKTeco BioTime system-group-add cross site scripting

A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input alert'XSS' leads to cross site scripting. It is possible to launch the...

CVE-2024-6440

CVE-2024-6440 affects SourceCodester Home Owners Collection Management System 1.0. Affected component: /classes/Master.php?f=delete_category; parameter id manipulation leads to SQL injection. Attack is possible remotely and exploitation has been disclosed publicly. Several connected documents con...

CVE-2024-6414

A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Export Page. The manipulation of the argument ID leads to direct request. It is possible to launch the attack remotely...

CVE-2024-6374

A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site...

CVE-2024-6275

A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file parent.php of the component Parent Page. The manipulation of the argument update leads to sql injection. The attack can be initiated remotel...