MyFinances Security Vulnerabilities

MyFinances is an open source web application from TreyWW Open Source. Designed to enable individuals and teams to manage their finances effectively. A security vulnerability exists in versions of MyFinances prior to 0.4.6 that stems from a method to access other customer invoices while logged in ...

PT-2024-27813 · Unknown · Myfinances

Name of the Vulnerable Software and Affected Versions: MyFinances versions prior to 0.4.6 Description: The issue allows an actor to access personally identifiable information PII and financial information from another account while signed in as a user. This is due to a method in the application...

New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers

Cybersecurity researchers have disclosed details of an ongoing phishing campaign that leverages recruiting- and job-themed lures to deliver a Windows-based backdoor named WARMCOOKIE. "WARMCOOKIE appears to be an initial backdoor tool used to scout out victim networks and deploy additional...

CVE-2024-37364

The CVE-2024-37364 entry concerns Ariane Allegro Scenario Player (through 2024-03-05) with Ariane Duo kiosk mode. A physically proximate attacker can access sensitive information (e.g., hotel invoices with PII) and potentially create unauthorized room keys by entering a guest-search quote charact...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

WordPress Expert Invoice plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Guido Iván García Duva in WordPress Plugin Expert Invoice versions = 1.0.2...

Expert Invoice <= 1.0.2 -Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Navigate to Expert Invoice Customer...

WordPress Expert Invoice Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Expert Invoice Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5172 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e96705f138f8 Credits Guido Iván García Duva...

BIT-PRESTASHOP-2024-34717 Anonymous PrestaShop customer can download other customers' invoices

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

CVE-2024-5236

A vulnerability classified as critical was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/teachersalaryinvoice1.php. The manipulation of the argument date leads to sql injection. The attack can be...

CVE-2024-5235

A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/teachersalaryinvoice.php. The manipulation of the argument teacherid leads to sql injection. It is possible to launch the attack...

Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns

Cybersecurity researchers have observed a spike in email phishing campaigns starting early March 2024 that delivers Latrodectus, a nascent malware loader believed to be the successor to the IcedID malware. "These campaigns typically involve a recognizable infection chain involving oversized...

CVE-2024-5110

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view/studentpaymentinvoice.php. The manipulation of the argument index leads to sql injection. The attack may be...

CVE-2024-5111

The CVE-2024-5111 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability arises from SQL injection in an unknown part of the file /view/student_payment_invoice1.php, triggered by manipulating the date argument. It is exploitable remotely and the exploit has been disc...

Complete Web-Based School Management System SQL注入漏洞

Campcodes Complete Web-Based School Management System is a Web-based school management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Web-Based School Management System version 1.0, which originates from an unknown function in /view/student...

Campcodes Complete Web-Based School Management System SQL注入漏洞

Campcodes Complete Web-Based School Management System is a Web-based school management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Web-Based School Management System version 1.0, which originates from an unknown function in /view/student...

PT-2024-34524 · Unknown · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Web-Based School Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file /view/student payment invoice1.php. The manipulation of the date argument lead...

Insecure Direct Object Reference (IDOR)

prestashop/prestashop is vulnerable to an Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient access controls, which allows any invoice to be downloaded from the front-office in anonymous mode by supplying a random securekey parameter in the URL...

CVE-2024-34717

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

CVE-2024-34717

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...