CVE-2024-29338

Anchor CMS v0.12.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the endpoint /anchor/admin/categories/delete/2. The Red Hat, Veracode, OSV, and other connected records consistently describe this CSRF issue as caused by insufficient validation for requests, enabling forged a...

CVE-2024-28559

CVE-2024-28559/Security issue in Niushop B2B2C (v5.3.3 and earlier) is a SQL injection in the setPrice() function of Goodsbatchset.php, enabling privilege escalation. Documented impact includes high severity (CVSSv3.1: 8.8, Network vector, Privileges Required: Low, User Interaction: None, Confide...

CVE-2024-28441

CVE-2024-28441 affects magicflue (v7.0 and earlier). The vulnerability is a file upload flaw that allows remote code execution via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint. Connected documents confirm affected software/version range and the exact parameter/...

CVE-2024-29366

DIR-845L routers with firmware <= 1.01KRb03 are vulnerable to a command injection in the cgibin binary, allowing arbitrary command execution. Affected product: D-Link DIR-845L (firmware

CVE-2024-25168

Snow Snow v2.0.0 is affected by a SQL injection in the dataScope parameter of the system/role/list interface, enabling a remote attacker to execute arbitrary code. The root cause is input handling in that endpoint, allowing injectable SQL statements. Documented impact is remote code execution wit...

CVE-2024-29865

Logpoint before 7.1.0 is vulnerable to Self-XSS on the LDAP authentication page when the attacker-supplied username is entered into the LDAP login form. Affected software: Logpoint prior to 7.1.0. Root cause: cross-site scripting on the LDAP login page. Impact: Self-XSS; exploitation requires use...

CVE-2024-29499

CVE-2024-29499 affects Anchor CMS v0.12.7 with a Cross-Site Request Forgery (CSRF) vulnerability at /anchor/admin/users/delete/2. The CVSS v3.1 base score is 7.4 (HIGH) with network attack vector, low attack complexity, requiring low privileges and user interaction set to none; scope: changed. Re...

CVE-2024-29385

The CVE concerns a D-Link DIR-845L router vulnerability (

CVE-2024-2776

CVE-2024-2776 affects Campcodes Online Marriage Registration System 1.0. The vulnerability is in an unknown function of /admin/search.php where manipulation of the searchdata parameter enables SQL injection. It is remotely exploitable and has been publicly disclosed (VDB-257610). Several connecte...

CVE-2024-2775

CVE-2024-2775 affects Campcodes Online Marriage Registration System 1.0. The vulnerability is a cross-site scripting flaw in the /user/user-profile.php file, triggered by manipulating the lname parameter. It can be exploited remotely and has been publicly disclosed. The issue remains in unknown p...

CVE-2024-2774

CVE-2024-2774 targets Campcodes Online Marriage Registration System 1.0. The vulnerability is in the /user/search.php endpoint, where manipulating the searchdata parameter leads to an SQL injection. It can be exploited remotely, with the exploit disclosed publicly. Public sources indicate potenti...

CVE-2023-42954

CVE-2023-42954 describes a privilege-escalation vulnerability in FileMaker Server prior to 20.3.1. When signed in to the Admin Console with an administrator role, an attacker could potentially access more sensitive information via front-end websites. The issue is mitigated by the 20.3.1 update, w...

CVE-2024-28045

CVE-2024-28045 involves cross-site scripting in Delta Electronics DIAEnergie. The issue stems from improper neutralization of input, affecting DIAEnergie systems (affected versions prior to v1.10.00.005). Exploitation could enable attacker-controlled scripts to run in user browsers, potentially c...

CVE-2024-25567

Delta Electronics DIAEnergie is affected by CVE-2024-25567 (Path traversal) in versions prior to v1.10.00.005. The flaw allows writing outside the intended directory and potential access to sensitive files, with overwrite of existing files possible. Root cause: path traversal (CWE-22). Impact per...

CVE-2024-28171

CVE-2024-28171 describes a path traversal vulnerability in Delta Electronics DIAEnergie. The issue allows an attacker to write outside the intended directory; if a file name already exists, the original file can be overwritten. Public-facing details in connected sources (e.g., EUVD-2024-25301, CN...

CVE-2024-23494

Delta Electronics DIAEnergie is affected by a SQL injection vulnerability (GetDIAE_unListParameters) in versions prior to v1.10.00.005. The issue is remotely exploitable with high impact (CVE-2024-23494, CVSS v3.1 score 8.8) and can lead to viewing or modifying backend data and potential persiste...

CVE-2024-29031

CVE-2024-29031 documents a SQL injection in Meshery (github.com/layer5io/meshery) affecting GetMeshSyncResources via the order parameter, prior to version 0.7.17. The root cause is improper input handling that could disclose sensitive information. The issue is mitigated by upgrading to version 0....

CVE-2024-23975

Delta Electronics DIAEnergie SQL injection (CVE-2024-23975) affects DIAEnergie prior to v1.10.00.005. The vulnerability is in the GetDIAE_slogListParameters function, enabling SQL injection that could allow an attacker to view/modify/delete data in the back-end database. The ICS advisory cites re...

CVE-2024-28040

Delta Electronics DIAEnergie prior to version 1.10.00.005 contains an SQL injection in the GetDIAE_astListParameters function. This is listed with a CVSS v3.1 base score of 8.8 (Network, Low attack complexity, Privileges required: Low, User interaction: None, Confidentiality/Integrity/Availabilit...

CVE-2024-28863

CVE-2024-28863 affects the npm package graph for Node.js via the node-tar library. The issue: node-tar prior to version 6.2.1 imposes no limit on the number of sub-folders created during folder extraction, enabling an attacker to produce a path with many sub-folders that can consume memory and cr...