CVE-2024-4509

CVE-2024-4509 affects Ruijie RG-UAC up to 20240428. The vulnerability is an OS command injection in the PHP endpoint /view/IPV6/naborTable/add_commit.php, triggered by manipulating the ip_addr/mac_addr arguments. It can be exploited remotely, and public disclosure of the exploit is noted. Affecte...

CVE-2024-33121

CVE-2024-33121 affects Roothub v2.6, where the SQL injection vulnerability exists in the search() function through the 's' parameter. Exploitation details are not provided in the documents, but multiple sources corroborate an SQL injection issue in Roothub v2.6. The CVSS v3.1 base score is 6.3 (M...

CVE-2024-34092

CVE-2024-34092 affects Archer Platform 6 before 2024.04. The issue is an authentication mishandling where a lock did not terminate an existing session, allowing continued access. A fixed release is 6.14 P3 (6.14.0.3) and later. The CVSS metrics indicate a high impact to confidentiality, integrity...

CVE-2024-34252

CVE-2024-34252 affects wasm3 v0.5.0, where a global buffer overflow in the function PreserveRegisterIfOccupied (wasm3/source/m3_compile.c) can cause a segmentation fault. The vulnerability is described across multiple sources (NVD, Red Hat, OSV, CNNVD, CVE CVE list) with CVSS v3.1 base score 7.5 ...

CVE-2024-33117

CVE-2024-33117 affects crmeb_java v1.3.4, with a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController . Documents indicate the issue exists in this component and provides a practical remediation: temporarily disable the mergeList method and ...

CVE-2024-33294

CVE-2024-33294 pertains to the Library System (PHP/MySQLi) v1.0, where a flaw in the file component student_edit_photo.php allows a remote attacker to execute arbitrary code via the _FAILE variable. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates a network-exposed, unauthentic...

CVE-2024-33410

CVE-2024-33410 is an SQL injection vulnerability affecting Campcodes Complete Web-Based School Management System 1.0, specifically in /model/delete_range_grade.php via the id parameter. The incident is described across multiple sources (NVD/Red Hat/CNNVD/CVE/CVELIST) with CVSS v3.1 base metrics: ...

CVE-2024-34532

CVE-2024-34532 : A SQL injection in the “Yvan Dotet PostgreSQL Query Deluxe” module (query_deluxe) for 17.x prior to 17.0.0.4 allows a remote attacker to gain privileges via the query parameter in models/querydeluxe.py:QueryDeluxe::get_result_from_query. Affected software: Yvan Dotet PostgreSQL Q...

CVE-2024-34533

ZI PT Solusi Usaha Mudah Analytic Data Query module (izi_data) versions 11.0–17.x prior to 17.0.3 are affected by a SQL injection that allows a remote attacker to gain privileges via IZITools::query_check, IZITools::query_fetch, or IZITools::query_execute. The root cause is a SQL-injection vulner...

CVE-2024-33405

CVE-2024-33405 concerns the Campcodes Complete Web-Based School Management System 1.0. The vulnerability is an SQL injection in the add_friends.php script, exploitable via the friend_index parameter, allowing an attacker to execute arbitrary SQL commands. The description across connected document...

CVE-2024-34538

CVE-2024-34538 affects Mateso PasswordSafe up to version 8.13.9.26689, which is reported to use weak cryptography. Multiple connected sources (Red Hat, NVD, CVE listing, CNVD, CVE enrichment feeds) corroborate the same payload: weak cryptography as the underlying issue. The CVSSv3.1 vector (AV:N/...

CVE-2024-33112

CVE-2024-33112 affects D-Link DIR-845L routers (v1.01KRb03 and earlier). The root cause is a command-injection vulnerability in the hnap_main() function when handling GetDeviceSettings via the HNAP interface, enabling remote attackers to execute arbitrary commands. Exploitation is network-vector ...

CVE-2024-33788

The CVE-2024-33788 belongs to Linksys E5600 firmware (v1.1.0.26). The issue is a command injection in the /API/info endpoint via the PinCode parameter due to insufficient input filtering, enabling arbitrary command execution. Impact is high (CVSSv3.1: AV Adjacent, AC L, PR L, UI N, C H, I H, A H)...

CVE-2024-33829

CVE-2024-33829 affects idccms v1.35, with a Cross-Site Request Forgery (CSRF) in the component accessible at /admin/readDeal.php?mudi=updateWebCache. The vulnerability is described across multiple sources as CSRF via that parameter; the NVD/CVE entry lists a CVSS v3.1 base score of 5.4 (Medium) w...

CVE-2024-33406

CVE-2024-33406 affects Campcodes Complete Web-Based School Management System 1.0. A SQL injection flaw exists in the /model/delete_student_grade_subject.php endpoint, exploitable via the index parameter to execute arbitrary SQL commands. The vulnerability originates from improper handling of user...

CVE-2024-33411

CVE-2024-33411 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability is a SQL injection in the /model/get_admin_profile.php endpoint, exploitable via the my_index parameter to execute arbitrary SQL commands. Impact is described as high confidentiality, integrity, an...

CVE-2024-4496

CVE-2024-4496 : A stack-based buffer overflow exists in the Tenda i21 firmware (version 1.0.0.14(4656)) originating from the parameter ssidIndex in the function formWifiMacFilterSet . The vulnerability allows remote attackers to trigger overflow, potentially leading to arbitrary code execution or...

CVE-2024-4495

CVE-2024-4495 affects Tenda i21 (firmware 1.0.0.14(4656)). The issue is in the function formWifiMacFilterGet where the index argument can be mishandled, causing a stack-based buffer overflow. Several connected sources confirm a remote-exploit capable scenario with this vulnerability, rated high/s...

CVE-2024-4494

CVE-2024-4494 affects Tenda i21 firmware version 1.0.0.14(4656). The vulnerability is a stack-based overflow in the function formSetUplinkInfo within the file /goform/setUplinkInfo , triggered by improper handling of the argument pingHostIp2 . Attack is network-based and can be executed remotely;...

CVE-2024-4492

The CVE-2024-4492 entry concerns Tenda i21 (firmware 1.0.0.14(4656)). The vulnerability is in the formOfflineSet function (/goform/setStaOffline) where manipulating the GO/ssidIndex argument causes a stack-based buffer overflow. It can be exploited remotely, and public exploit details have been d...