CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

CVE-2024-50857

The ipdojob request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting XSS. It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

CVE-2024-50861

The ipmoddnskeyform.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks...

CVE-2024-48760

An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution...

CVE-2024-50861

The ipmoddnskeyform.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks...

CVE-2024-50857

The ipdojob request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting XSS. It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

CVE-2024-48760

GestioIP v3.5.7 is vulnerable to Remote Command Execution (RCE) due to a flaw in the file upload function. An attacker can upload a malicious perlcmd.cgi file that overwrites the legitimate upload.cgi file, enabling arbitrary code execution. The vulnerability can be exploited without a password i...

CVE-2024-50858

GestioIP v3.5.7 is vulnerable to Cross-Site Request Forgery (CSRF) affecting multiple endpoints. An attacker can trick an authenticated administrator into visiting a malicious URL, enabling the execution of unauthorized actions such as data modification, deletion, or exfiltration . A specific pre...

CVE-2024-50859

The GestioIP v3.5.7 web-based address management software is vulnerable to Reflected Cross-Site Scripting (XSS) via the ip_import_acl_csv request. The root cause is the failure to sanitize content when a user uploads an improperly formatted file ; the system reflects the file's content in the HTM...

CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

CVE-2024-48760

An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution...

CVE-2024-50861

GestioIP version 3.5.7 is vulnerable to Stored XSS via the ip_mod_dns_key_form.cgi request. An authenticated attacker with appropriate permissions can inject malicious code into the TSIG Key field, which is then stored in the database. When any user accesses the DNS Key page, the script triggers,...

CVE-2024-50857

GestioIP version v3.5.7 is vulnerable to Reflected and Persistent Cross-Site Scripting (XSS) via the ip_do_job request due to unsanitized input. This vulnerability allows attackers to execute scripts in a victim's browser, potentially leading to data exfiltration and enabling CSRF attacks . Succe...