CVE-2024-4928

CVE-2024-4928 affects SourceCodester Simple Online Bidding System v1.0. A SQL injection vulnerability exists in the vulnerable endpoint /simple-online-bidding-system/admin/ajax.php?action=delete_category where manipulating the id parameter can lead to unauthorized data access via SQL injection. E...

CVE-2024-4927

CVE-2024-4927 affects SourceCodester Simple Online Bidding System 1.0. The issue resides in an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product, enabling unrestricted file uploads and allowing remote exploitation. Multiple sources note this as a c...

CVE-2024-4925

CVE-2024-4925 affects SourceCodester School Intramurals Student Attendance Management System v1.0. The vulnerability is in the handling of the file /intrams_sams/manage_course.php, where manipulation of the id parameter enables SQL injection. The issue can be exploited remotely, and public exploi...

CVE-2024-4922

SourceCodester Simple Image Stack Website 1.0 is affected by a Cross-Site Scripting (XSS) issue arising from manipulation of the page parameter. The vulnerability can be triggered remotely, and multiple sources corroborate the issue without detailing a confirmed patch. Remediation guidance in rel...

CVE-2024-4918

CVE-2024-4918 affects Campcodes Online Examination System 1.0. The issue resides in the file updateQuestion.php, where manipulation of the parameter id leads to a SQL injection vulnerability. The vulnerability can be exploited remotely and has been disclosed publicly. Multiple sources corroborate...

CVE-2024-4914

The CVE-2024-4914 entry affects Campcodes Online Examination System 1.0, where the vulnerability lies in ranking-exam.php: the manipulation of the exam_id parameter enables SQL injection. This can be exploited remotely, and public disclosures exist. The connected sources confirm affected software...

CVE-2024-35184

CVE-2024-35184 affects Paperless-ngx before 2.8.6. Evidence from PT-2024-26365 and ongoing CVE records shows that versions 2.5.0 through 2.8.5 expose remote API access via authentication that can be used even when API access is disabled. The root cause per the advisory is improper enforcement of ...

CVE-2024-4913

The CVE-2024-4913 entry concerns Campcodes Online Examination System version 1.0, affecting the file exam.php. The vulnerability arises from manipulation of the id argument, enabling SQL injection. Exploitation appears possible remotely and public disclosure exists. Several connected sources reit...

CVE-2024-4947

The CVE-2024-4947 entry corresponds to a Type Confusion vulnerability in Google Chrome/Chromium V8 that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected software is the Chrome/Chromium stack using V8 prior to version 125.0.6422.60. The root c...

CVE-2024-4949

Google Chrome versions prior to 125.0.6422.60 are vulnerable to a use-after-free flaw in the V8 engine . A remote attacker can exploit this via a crafted HTML page to potentially trigger heap corruption . Exploitation of this vulnerability may allow for the execution of arbitrary code . Remediati...

CVE-2024-27243

CVE-2024-27243 describes a buffer overflow in Zoom Workplace Apps and SDKs. The vulnerability affects Zoom’s Workplace components when processing untrusted input, allowing an authenticated user to cause a denial of service over a network connection. The CVSSv3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:...

CVE-2024-4976

CVE-2024-4976 affects Xpdf; an out-of-bounds write occurs in AcroForm field reference due to a missing object type check in Xpdf 4.05 and earlier. Fedora advisories and Slackware/Nessus entries corroborate impact and note remediation by updating to 4.06. Practical impact is an out-of-bounds write...

CVE-2024-4911

CVE-2024-4911 affects Campcodes Complete Web-Based School Management System v1.0. The vulnerability is in /view/student_exam_mark_update_form.php where manipulation of the exam parameter enables SQL injection, admitting remote exploitation. Multiple connected sources confirm the issue without det...

CVE-2024-31409

CVE-2024-31409 affects CyberPower PowerPanel software. The vulnerability arises from insufficient authorization due to MQTT wildcards not being blocked, which could allow an attacker who gains access to any device to read data from across the system. Affected product: PowerPanel (enterprise/busin...

CVE-2024-4910

The CVE-2024-4910 issue affects Campcodes Complete Web-Based School Management System 1.0. Affects an unknown functionality in the file /view/student_exam_mark_insert_form1.php, where manipulating the grade parameter enables SQL injection. The vulnerability can be exploited remotely and has been ...

CVE-2024-31856

CVE-2024-31856 affects CyberPower PowerPanel Business. Affected: PowerPanel business (4.9.0 and prior). Issue: SQL injection vulnerability triggered by processing MQTT messages, enabling an attacker with certain MQTT permissions to inject SQL, write arbitrary files, and potentially execute remote...

CVE-2024-32042

CVE-2024-32042 affects CyberPower PowerPanel Business Edition (PowerPanel business). Root cause: the cryptographic key used to encrypt passwords stored in the database is present in the PowerPanel application code, allowing recovery of those passwords (Storing Passwords in a Recoverable Format). ...

CVE-2024-32053

CVE-2024-32053 affects CyberPower PowerPanel Business Platform, where hard-coded credentials are used for authentication to the database, other services, and the cloud. The result is potential attacker access with PowerPanel business application privileges. Mitigation in the Connected documents: ...

CVE-2024-34909

The knowledge base management system KYKMS is vulnerable to an arbitrary file upload vulnerability in versions 1.0.1 and below . Attackers can exploit this by uploading a crafted PDF file to achieve arbitrary code execution . While some records also associate this ID with a cross-site scripting (...

CVE-2024-33615

CVE-2024-33615 affects CyberPower PowerPanel Business (PowerPanel business) up to version 4.9.0. A specially crafted ZIP containing path traversal characters can be imported to the server, enabling writing files outside the intended scope and potentially remote code execution. Remediation: CyberP...