CVE-2024-46049

CVE-2024-46049 affects Tenda O6 V3.0 firmware 1.0.0.7(2054) and contains a stack overflow in the internal formexeCommand function. The available connected documentation explicitly pinpoints the vulnerable component as the formexeCommand function and confirms the issue as a stack overflow. The PT-...

CVE-2024-46049

Tenda O6 V3.0 firmware V1.0.0.72054 contains a stack overflow vulnerability in the formexeCommand function...

CVE-2024-44867

phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php...

CVE-2024-44871

CVE-2024-44871 affects moziloCMS v3.0. An arbitrary file upload vulnerability exists in the /admin/index.php component that enables an authenticated attacker to achieve arbitrary code execution by uploading a crafted file (e.g., a JPG) and renaming it to PHP via the admin interface. Multiple sour...

CVE-2024-44871

An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-44867

phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php...

CVE-2024-44867

Summary: CVE-2024-44867 affects phpok v3.0, with an arbitrary file read vulnerability in the /autoload/file.php component. Across connected sources (Red Hat, NVD, CVE lists, CNNVD, CVE list, vulnrichment), the description consistently states the issue is an arbitrary file read in phpok v3.0. No e...

CVE-2024-44867

phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php...

CVE-2024-44871

An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted file...

Fedora: Security Advisory (FEDORA-2024-000a25f3fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS)

There is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted "protected" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

CVE-2024-24034

CVE-2024-24034 affects Setor Informatica S.I.L v3.0. The root cause is an open redirect in the hprinter parameter, enabling remote attackers to achieve arbitrary code execution. Public references (including PT-2024-20248) indicate exploitation via the hprinter parameter, with guidance to avoid us...

PHPJabbers Car Park Booking System 3.0 Cross Site Scripting / HTML Injection

Exploit Title: PHPJabbers Car Park Booking System v3.0 - Multiple Stored XSS Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-park-booking/sectionDemo Version: v3.0 Tested on:...

CVE-2023-48834

A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion...

Privilege escalation

A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion...

CVE-2023-48834

CVE-2023-48834 affects Car Rental Script v3.0, caused by a missing rate limit in the function pjActionAjaxSend, enabling unauthenticated attackers to exhaust resources over the network. Exploitation context is supported by multiple sources (e.g., PT-Security guidance and public writeups). Remedia...

CVE-2023-48835

CVE-2023-48835 affects Car Rental Script v3.0; the vulnerability is a CSV Injection in the Language > Labels > Export action due to insufficient input validation on the Unique ID field in Reservations. Impact is high (C:H, I:H, A:H) with CVSS 3.1 base score 8.8. In-the-wild/exploit details ...

Cross site scripting

Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...

CVE-2023-45394

Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...