CVE-2024-57765

MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the sname parameter at table/list...

CVE-2024-57766

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField...

CVE-2024-57767

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery SSRF via the component /file/download...

CVE-2024-57764

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add...

CVE-2024-57767

CVE-2024-57767 affects MSFM prior to 2025.01.01 and describes a Server-Side Request Forgery (SSRF) via the "/file/download" component. The root cause is an SSRF vulnerability in the file-download functionality, enabling an attacker to access internal resources through the affected module. The CVS...

CVE-2024-57766

CVE-2024-57766 affects MSFM prior to 2025-01-01, with a fastjson deserialization vulnerability in the component system/table/editField. The CVSS v3.1 base score is 9.1 (CRITICAL): Network attack, no user interaction, no privileges required, with high confidentiality and integrity impact. Document...

CVE-2024-57767

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery SSRF via the component /file/download...

CVE-2024-57765

MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the sname parameter at table/list...

PT-2025-3561 · Msfm · Msfm

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to v2025.01.01 Description: The issue is related to a Server-Side Request Forgery SSRF in MSFM, which occurs via the /file/download component. This allows for unauthorized access to internal resources. Recommendations: For...

CVE-2024-57763

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField...

CVE-2024-57765

MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the sname parameter at table/list...