CVE-2024-5372

CVE-2024-5372 affects Kashipara College Management System 1.0. The vulnerability is in the file submit_extracurricular_activity.php, where manipulation of the activity_contact parameter enables cross-site scripting. Exploitation can be performed remotely, and multiple connected sources corroborat...

CVE-2024-5369

CVE-2024-5369 affects Kashipara College Management System 1.0. The vulnerability is in the file submit_admin.php, where manipulating the argument admin_name triggers cross-site scripting (XSS) . The attack is described as remotely exploitable and the exploit has been disclosed publicly (VDB-26628...

CVE-2024-34152

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server...

CVE-2024-36241

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command...

CVE-2024-34029

Mattermost versions 9.5.x /channels//link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team...

CVE-2024-31859

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin...

CVE-2024-5366

The CVE-2024-5366 entry concerns the SourceCodester Best House Rental Management System (versions up to 1.0). A vulnerability in edit-cate.php arises from improper handling of the id parameter, enabling SQL injection. Reported as exploitable remotely and publicly disclosed (VDB-266278). Connected...

CVE-2024-36241

Mattermost Server vulnerable versions: 8.1.x up to 8.1.12; 9.5.x up to 9.5.3; 9.6.x up to 9.6.1. Issue: improper access controls allow viewing arbitrary post contents via the /playbook add slash command. Root cause: failure to enforce access restrictions. Impact: exposure of post content to unaut...

CVE-2024-34152

CVE-2024-34152 affects Mattermost Server releases: 8.1.x up to 8.1.12, 9.5.x up to 9.5.3, and 9.6.x up to 9.6.1. The issue is improper access control that lets a guest retrieve metadata of a public playbook run linked to a channel the guest is in by sending an RHSRuns GraphQL query. The connected...

CVE-2024-34029

Mattermost suffers an authorization bypass in /api/v4/groups//channels//link, allowing a user to learn members of an AD/LDAP group linked to a team without having access to that team. Affected are Mattermost Server/Mattermost releases: 9.5.x up to 9.5.3, 9.7.x up to 9.7.1, and 8.1.x up to 8.1.12....

CVE-2024-5365

CVE-2024-5365 affects SourceCodester Best House Rental Management System up to version 1.0. The vulnerability lies in the manage_payment.php file where manipulating the id parameter leads to an SQL injection. It can be triggered remotely, and public exploits have been disclosed. Multiple sources ...

CVE-2024-5364

CVE-2024-5364 affects SourceCodester Best House Rental Management System v1.0 and earlier, with a SQL injection in the manage_tenant.php file triggered by modifying the id parameter. The vulnerability is exploitable remotely and has public disclosures. The issue stems from improper handling of th...

CVE-2024-5363

CVE-2024-5363 affects SourceCodester Best House Rental Management System up to v1.0. The vulnerability is in the manage_user.php file where manipulating the id parameter leads to a SQL injection. Exploitation can be performed remotely; public disclosure cited. No remediation details (patch/versio...

CVE-2024-5361

CVE-2024-5361 refers to a SQL injection vulnerability in PHPGurukul Zoo Management System 2.1, specifically in the file /admin/normal-bwdates-reports-details.php where the parameter fromdate can be manipulated to trigger database injection. Several connected records corroborate remote exploitatio...

CVE-2024-5360

PHPGurukul Zoo Management System 2.1 contains a SQL injection in /admin/foreigner-bwdates-reports-details.php via the fromdate parameter. The vulnerability allows remote exploitation and has been publicly disclosed. Several sources corroborate impact and scope but do not provide an available fix/...

CVE-2024-5358

CVE-2024-5358 affects PHPGurukul Zoo Management System 2.1, specifically the /admin/normal-search.php file. The vulnerability arises from unsafely manipulating the searchdata argument, leading to SQL injection. Exploitation is described as remote, with public disclosure. Remediation or patches ar...

CVE-2024-5357

CVE-2024-5357 concerns a SQL injection in PHPGurukul Zoo Management System 2.1, triggered by manipulating the email parameter in /admin/forgot-password.php. The attack is remotely exploitable and affects an unknown functionality, with multiple sources labeling it as critical/high impact. Connecte...

CVE-2024-5355

CVE-2024-5355 affects anji-plus AJ-Report up to version 1.4.1, with the IGroovyHandler function vulnerable to command injection that can be exploited remotely. Public exploit information exists. A practical mitigation from PT-security suggests disabling the IGroovyHandler function as a temporary ...

CVE-2024-5354

Summary: CVE-2024-5354 affects the anji-plus AJ-Report product (versions up to 1.4.1). The vulnerability exists in the /reportShare/detailByCode endpoint, where manipulating the shareToken can disclose information. It is exploitable remotely over a network. Public exploitation has been disclosed....

CVE-2024-5353

CVE-2024-5353 affects anji-plus AJ-Report up to 1.4.1. The issue is a path traversal in the ZIP File Handler decompress function, allowing remote initiation. Exploit has been disclosed publicly. No remediation details are provided in the connected documents; no explicit fixes or patched versions ...