CVE-2024-33807

CVE-2024-33807 : A SQL injection flaw in Campcodes’ Complete Web-Based School Management System v1.0 affects the endpoint /model/get_teacher_timetable.php. The vulnerability allows an attacker to inject arbitrary SQL through the grade parameter. Public sources in the connected documents consisten...

CVE-2024-33806

CVE-2024-33806 affects campcodes Complete Web-Based School Management System 1.0. The vulnerability is in the /model/get_grade.php endpoint, where the id parameter enables a SQL injection. The underlying root cause is improper input handling, allowing an attacker to execute arbitrary SQL commands...

CVE-2024-33805

The CVE-2024-33805 issue affects Campcodes Complete Web-Based School Management System 1.0, specifically the /model/get_student.php endpoint. A SQL injection via the id parameter is used to execute arbitrary SQL commands, enabling high-severity impact on confidentiality, integrity, and availabili...

CVE-2024-33804

CVE-2024-33804 affects campcodes Complete Web-Based School Management System 1.0. The vulnerability is a SQL injection in /model/get_subject.php through the id parameter, allowing a attacker to execute arbitrary SQL commands. Publicly available sources in the connected set consistently describe t...

CVE-2024-33803

CVE-2024-33803 affects Campcodes Complete Web-Based School Management System 1.0. A SQL injection exists in /model/get_exam.php via the id parameter, enabling arbitrary SQL commands as described in multiple sources. The vulnerability is documented with a CVSS v3.1 base score of 5.4 (Medium) with ...

CVE-2024-33802

CVE-2024-33802 describes an SQL injection in Campcodes Complete Web-Based School Management System 1.0. The vulnerability affects /model/get_student_subject.php and is exploitable via the index parameter, allowing an attacker to execute arbitrary SQL commands. Exploitation status is not provided ...

CVE-2024-33801

Affects: Campcodes Complete Web-Based School Management System v1.0. Vulnerable component: /model/get_subject_routing.php. Root cause: SQL injection via the id parameter that allows arbitrary SQL execution. Impact (per sources): high confidentiality, integrity, and availability implications; over...

CVE-2024-33800

CVE-2024-33800 affects Campcodes Complete Web-Based School Management System v1.0. A SQL injection is possible in the /model/get_student1.php endpoint, via the index parameter, enabling an attacker to execute arbitrary SQL commands. The vulnerability is documented across multiple sources (NVD/Red...

CVE-2024-33799

CVE-2024-33799 affects Campcodes Complete Web-Based School Management System 1.0, via the /model/get_teacher.php endpoint where the id parameter is used unsafely. The root cause is a SQL injection that allows an attacker to execute arbitrary SQL commands, enabling potentially complete compromise ...

CVE-2024-35621

Formwork CVE-2024-35621 is an XSS in the Edit function prior to 1.13.0, exploitable via a crafted payload in the Content field. Root cause: insufficient sanitization of markdown fields, enabling [removed] tags to reach public pages through editor content. Affected: Formwork before 1.13.0. Impact:...

CVE-2024-24851

CVE-2024-24851 affects the AutomationDirect Productivity2010 P3-550E CPU (FW 1.2.10.9) via the Programming Software Connection FiBurn heap-based buffer overflow. A specially crafted, unauthenticated UDP/packet can trigger memory corruption: the Talos advisory details a flow where an attacker can ...

CVE-2024-24946

AutomationDirect P3-550E firmware 1.2.10.9 is affected by a heap-based buffer overflow in the CurrDir handling of the Programming Software Connection service. A crafted, unauthenticated UDP packet can trigger memory corruption via a memset operation based on attacker-controlled length, offsetting...

CVE-2024-24947

CVE-2024-24947 affects AutomationDirect P3-550E CPU (FW 1.2.10.9) with a heap-based buffer overflow in the CurrDir handling of the Programming Software Connection. The root cause is a memset call using an attacker-controlled length, causing heap corruption at offset 0xb68c4 and potential DoS via ...

CVE-2024-24958

Summary: CVE-2024-24958 affects AutomationDirect P3-550E (FW 1.2.10.9) and relates to an out-of-bounds write in the Programming Software Connection FileSystem API, causing heap-based memory corruption when processing crafted network packets. The TALOS report documents multiple null-byte write var...

CVE-2024-24959

AutomationDirect Productivity PLCs P3-550E CPU (FW 1.2.10.9; SW 4.1.1.10) are affected by multiple CVEs (CVE-2024-24959 among others) in the Programming Software Connection FileSystem API and related components. Talos reports several out-of-bounds write vulnerabilities and null-byte write flaws a...

CVE-2024-24957

AutomationDirect Productivity PLCs (P3-550E CPU) with FW 1.2.10.9 are affected by CVE-2024-24957, part of a set of out-of-bounds/write vulnerabilities in the Programming Software Connection FileSystem API. The Talos report documents multiple null-byte write and related overflow issues that can be...

CVE-2024-24956

Summary of CVE-2024-24956 (AutomationDirect P3-550E) : Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API of AutomationDirect P3-550E FW 1.2.10.9, enabling heap-based memory corruption via specially crafted network packets. The Talos report det...

CVE-2024-24955

CVE-2024-24955 concerns the AutomationDirect P3-550E CPU (FW 1.2.10.9) where the Programming Software Connection FileSystem API exhibits out-of-bounds/null-byte write vulnerabilities. Talos details show multiple related cases (IMM 0x0F03/04/06/0E/14/16) causing heap-based memory corruption by wri...

CVE-2024-24954

AutomationDirect P3-550E (FW 1.2.10.9; related P3-550/P3-530 family in Rad Red Hat doc) is affected by CVE-2024-24954, a set of out-of-bounds/null-byte write vulnerabilities in the Programming Software Connection FileSystem API. Talos details show multiple CVEs in the same firmware, with CVE-2024...

CVE-2024-24962

CVE-2024-24962 affects AutomationDirect Productivity3000 P3-550E CPU (FW 1.2.10.9) with a stack-based buffer overflow in the Programming Software Connection FileSelect path handling. TALOS reports the vulnerability at offset 0xb6e98 in the IMM 0F FileSelect_Handler, caused by unsafely using strnc...