CVE-2024-24571 facileManager Systemic Cross-Site Scripting (XSS)

facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation...

CVE-2024-24571 facileManager Systemic Cross-Site Scripting (XSS)

facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation...

CVE-2024-24571

CVE-2024-24571 concerns the facileManager web application. Multiple connected sources confirm a systemic Cross-Site Scripting (XSS) vulnerability in versions 4.5.0 and earlier, arising from insufficient input validation in almost all input fields. The issue is described across NVD, Red Hat, CNVD/...

CVE-2024-24571 facileManager Systemic Cross-Site Scripting (XSS)

facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation...

CVE-2024-24571

facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation...

facileManager 安全漏洞

facileManager is facileManager company's set of modular Web applications . A cross-site scripting vulnerability exists in facileManager that stems from insufficient input validation and can be exploited by an attacker to steal a victim's cookie-based authentication credentials...

CVE-2024-24571: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation...

CVE-2024-24573: Incorrect Authorization

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can...

PT-2024-20463

Name of the Vulnerable Software and Affected Versions facileManager versions 4.5.0 and earlier Description The issue allows non-admin users to arbitrarily set their permissions and grant their non-admin accounts with super user privileges when updating their profile. This is done through a POST...

facileManager 安全漏洞

facileManager is a set of modular Web applications from facileManager Inc. An elevation of privilege vulnerability exists in facileManager that stems from improper privilege management. An attacker can exploit this vulnerability to gain elevated privileges on the system...

PT-2024-20461 · Unknown · File Manager

Name of the Vulnerable Software and Affected Versions: facileManager versions 4.5.0 and earlier Description: The issue is related to insufficient input validation, which leads to cross-site scripting XSS in almost all input fields of the facileManager web application. Recommendations: For version...

CVE-2024-24572: Improper Neutralization of Special Elements used in an SQL Command

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $REQUEST global array was unsafely called inside an extract function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $SESSION via the GET/POST parameters...

PT-2024-20462

Name of the Vulnerable Software and Affected Versions facileManager versions 4.5.0 and earlier Description The issue concerns a modular suite of web apps built with the sysadmin in mind. In the affected versions, the $ REQUEST global array was unsafely called inside an extract function in...