CVE-2024-57765

MSFM is affected by a SQL injection in the s_name parameter exposed at the table/list endpoint, with versions prior to 2025.01.01 vulnerable. Exploitation could allow execution of arbitrary SQL and theft of sensitive data (per CNVD/CNNVD). Remediation details are not uniformly provided across sou...

CVE-2024-57767

CVE-2024-57767 affects MSFM prior to 2025.01.01 and describes a Server-Side Request Forgery (SSRF) via the "/file/download" component. The root cause is an SSRF vulnerability in the file-download functionality, enabling an attacker to access internal resources through the affected module. The CVS...