CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

CVE-2024-50857

The ipdojob request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting XSS. It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully...

CVE-2024-50861

The ipmoddnskeyform.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks...

CVE-2024-48760

An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution...

CVE-2024-48760

An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution...

CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

CVE-2024-50861

GestioIP version 3.5.7 is vulnerable to Stored XSS via the ip_mod_dns_key_form.cgi request. An authenticated attacker with appropriate permissions can inject malicious code into the TSIG Key field, which is then stored in the database. When any user accesses the DNS Key page, the script triggers,...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

CVE-2024-48760

GestioIP v3.5.7 is vulnerable to remote command execution (RCE) due to an unsafe file upload handler located at /api/upload.cgi. A remote attacker can upload a malicious perlcmd.cgi file to overwrite the original upload.cgi file, enabling the execution of arbitrary commands. Exploitation is possi...

CVE-2024-50858

The web-based IPv4/IPv6 address management software GestioIP version 3.5.7 is vulnerable to Cross-Site Request Forgery (CSRF) across multiple endpoints. An attacker can trick an administrator into visiting a malicious URL to execute unauthorized actions, potentially resulting in data modification...

CVE-2024-50859

The GestioIP v3.5.7 web-based address management software is vulnerable to Reflected Cross-Site Scripting (XSS) via the ip_import_acl_csv request. The root cause is the failure to sanitize content when a user uploads an improperly formatted file ; the system reflects the file's content in the HTM...

CVE-2024-50857

The ipdojob request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting XSS. It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully...

CVE-2024-50861

The ipmoddnskeyform.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks...

CVE-2024-50857

GestioIP version v3.5.7 is vulnerable to Cross-Site Scripting (XSS) due to unsanitized input in the ip_do_job request. This flaw allows attackers to execute scripts in a victim's browser, potentially leading to data exfiltration and Cross-Site Request Forgery (CSRF) attacks. Successful exploitati...