CVE-2024-28431

CVE-2024-28431 affects DedeCMS v5.7, with a CSRF vulnerability in the /dede/catalog_del.php component. The issue is described across multiple sources as Cross-Site Request Forgery, enabling malicious requests without user consent. The available documentation provides the affected software/version...

CVE-2024-28668

CVE-2024-28668 affects DedeCMS v5.7 with a Cross-Site Request Forgery (CSRF) vulnerability in the component /dede/mychannel_add.php. The issue is described across multiple sources as CSRF, with initial metrics indicating CVSS v3.1 base score 6.1 (MEDIUM). No concrete remediation details are provi...

CVE-2024-28684

DedeCMS v5.7 is affected by a Cross-Site Request Forgery (CSRF) in the component /dede/module_main.php. The CVE-2024-28684 entry notes an attack that can impact confidentiality, integrity, and availability (CVSSv3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base score 8.8). The issue requires user in...

CVE-2024-25250

CVE-2024-25250 describes an SQL injection in the Agro-School Management System (v1.0) Login page that can lead to arbitrary code execution. Affected component: Login handling; root cause: unsafe SQL handling through user input. Impact per the entry: high confidentiality, integrity, and availabili...

CVE-2024-28681

DedeCMS v5.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /dede/plus_edit.php endpoint. The issue is documented across multiple sources (NVD, Red Hat, PRION, CNNVD, CVE listing, and OpenVAS) as a CSRF in the DedeCMS 5.7 series; no remote code execution or authe...

Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2024-1330)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-28672

DedeCMS v5.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /dede/media_edit.php endpoint. Multiple connected sources (Red Hat, CNNVD, PRION, NVD, OpenVAS note) confirm the CSRF issue on DedeCMS v5.7, but the precise root cause, affected parameters, or exploit de...

CVE-2023-41505

CVE-2023-41505 affects Student Enrollment In PHP v1.0’s Add Student’s Profile Picture function. Root cause: arbitrary file upload of a crafted PHP payload enabling remote code execution. Impact is described as high confidentiality, integrity, and availability concerns. Exploitation context provid...

CVE-2023-36238

CVE-2023-36238 is an IDOR in Bagisto v1.5.1 that allows an attacker to obtain sensitive information by manipulating the invoice ID parameter. The vulnerability is rooted in insufficient validation of the invoice ID passed to the application, with Red Hat and Veracode sources describing the issue ...

CVE-2024-28430

CVE-2024-28430 concerns DedeCMS v5.7 and a Cross‑Site Request Forgery (CSRF) flaw in the /dede/catalog_edit.php component. Public descriptions from Red Hat and OpenVAS corroborate a CSRF issue affecting DedeCMS 5.7, with multiple sources noting the vulnerability originates from that specific edit...

CVE-2024-28682

DedeCMS v5.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can be triggered via the /dede/sys_cache_up.php API. The Red Hat and OpenVAS-derived data confirm the CSRF issue, with components referencing DedeCMS 5.7 and the /dede/sys_cache_up.php entry point. PT Security addi...

CVE-2024-28676

Summary: CVE-2024-28676 affects DedeCMS v5.7 with a cross-site scripting (XSS) flaw exposed via the /dede/article_edit.php endpoint. The vulnerability is characterized as XSS that could impact users interacting with that API path. Several connected advisories confirm the issue but do not provide ...

CVE-2024-28683

DedeCMS v5.7 is affected by a cross-site scripting (XSS) vulnerability via the create file feature. Multiple connected sources confirm the issue in DedeCMS v5.7 (including references to SP2 in OpenVAS) and describe the root cause as an XSS exposed by file-creation tooling. Practical impact stated...

CVE-2024-28662

CVE-2024-28662 affects Piwigo prior to 14.3.0, with a Cross-Site Scripting (XSS) vulnerability caused by missing sanitization in the function that handles tagging (admin/include/functions.php: create_tag). Exploitation details are not provided in the documents, but the issue is clearly linked to ...

CVE-2024-28673

CVE-2024-28673 affects DedeCMS v5.7 and describes a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /dede/mychannel_edit.php endpoint. The NVD/Red Hat and related feeds consistently cite CSRF impact with a CVSSv3.1 base score of 8.8 (High) and a user interaction requirement. T...

CVE-2024-28669

DedeCMS v5.7 is reported to be vulnerable to a Cross-Site Request Forgery (CSRF) via the endpoint /dede/freelist_edit.php. The available sources identify the affected software/version and the CSRF issue but do not provide technical details such as exact request parameters, root cause, exploit ste...

CVE-2024-28675

DedeCMS v5.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /dede/diy_edit.php endpoint. The CVE describes CSRF with high impact potential (C, I, A HIGH; CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No exploit details are provided in the primary documents; exp...

CVE-2024-28677

DedeCMS v5.7 contains a Cross-Site Request Forgery (CSRF) vulnerability via the /dede/article_keywords_main.php endpoint. Multiple sources (NVD/Red Hat/CNNVD/CVE listings, OpenVAS notes) corroborate a CSRF issue affecting DedeCMS 5.7; no explicit exploit details or fixed version are provided in t...

CVE-2023-41504

CVE-2023-41504 affects the open‑source project Student Enrollment In PHP version 1.0. The vulnerability is a SQL injection in the Student Search function, enabling an attacker to execute arbitrary code. Root cause: unsafe handling of user input in SQL queries. Impact: high (arbitrary code executi...

CVE-2024-28665

Summary (CVE-2024-28665) DedeCMS v5.7 is reported to have a Cross-Site Request Forgery (CSRF) vulnerability through the component /dede/article_add.php. The available connected records confirm the affected product and page, but do not provide a confirmed patch version or remediation steps. The CS...