CVE-2024-6951

The CVE-2024-6951 entry corresponds to a SQL injection in SourceCodester Simple Online Book Store System 1.0,具体 affecting the admin_delete.php logic where the bookisbn parameter is manipulated. Exploitation can be performed remotely and has been disclosed publicly, with multiple sources assigning...

CVE-2024-6951 SourceCodester Simple Online Book Store System admin_delete.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Simple Online Book Store System 1.0. This affects an unknown part of the file admindelete.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to initiate the attack remotely. The explo...

CVE-2024-6950 Prain HTTP POST Request ?import code injection

A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0. Affected by this issue is some unknown functionality of the file /?import of the component HTTP POST Request Handler. The manipulation of the argument file leads to code injection. The attack may be launched...

CVE-2024-6950

Prain up to version 1.3.0 is affected by CVE-2024-6950 in the HTTP POST Request Handler’s /?import path. The issue arises from manipulation of the file argument, enabling remote code injection. Exploitation is described as remote and publicly disclosed, with Affected versions up to 1.3.0. The PT-...

CVE-2024-6950 Prain HTTP POST Request ?import code injection

A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0. Affected by this issue is some unknown functionality of the file /?import of the component HTTP POST Request Handler. The manipulation of the argument file leads to code injection. The attack may be launched...

CVE-2024-6949 Gargaj wuhu path traversal

A vulnerability classified as problematic was found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected by this vulnerability is an unknown functionality of the file /pages.php?edit=News. The manipulation leads to path traversal. The attack can be launched remotely. The exploi...

CVE-2024-6948

CVE-2024-6948 affects Gargaj wuhu Slide Editor, specifically the /slideeditor.php file. The vulnerability stems from manipulating the newSlideFile argument, causing unrestricted upload, which can be exploited remotely. Several connected sources confirm the issue but do not provide concrete produc...

CVE-2024-6947 Flute CMS Notification ContentParser.php replaceContent code injection

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection. The attack may be initiated remotely...

CVE-2024-6947

CVE-2024-6947 affects Flute CMS 0.2.2.4-alpha. The issue is in the replaceContent function of ContentParser.php in the Notification Handler, allowing remote code injection. The vulnerability has been publicly disclosed and can be exploited remotely. Mitigation references suggest disabling the rep...

CVE-2024-6946 Flute CMS list code injection

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been declared as critical. This vulnerability affects unknown code of the file /admin/pages/list. The manipulation of the argument blocks leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2024-6946 Flute CMS list code injection

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been declared as critical. This vulnerability affects unknown code of the file /admin/pages/list. The manipulation of the argument blocks leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2024-6946 Flute CMS list code injection

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been declared as critical. This vulnerability affects unknown code of the file /admin/pages/list. The manipulation of the argument blocks leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2024-6945 Flute CMS Avatar Upload Page ImagesController.php unrestricted upload

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been classified as critical. This affects an unknown part of the file app/Core/Http/Controllers/Profile/ImagesController.php of the component Avatar Upload Page. The manipulation of the argument avatar leads to unrestricted upload. It i...

CVE-2024-6945

Flute CMS 0.2.2.4-alpha contains a critical flaw in the Avatar Upload Page component, affecting the file app/Core/Http/Controllers/Profile/ImagesController.php. The vulnerability arises from manipulating the avatar parameter, enabling unrestricted remote upload. Multiple sources confirm exploitat...

CVE-2024-6944 ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization

A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function getimagebase64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has bee...

CVE-2024-6944

CVE-2024-6944 affects ZhongBangKeJi CRMEB up to version 5.4.0. The vulnerability resides in PublicController.php, get_image_base64, where manipulating the file argument leads to deserialization. This can be exploited remotely, and public exploits have been disclosed (VDB-272066). Red Hat and PT S...

CVE-2024-6943

A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserialization. The attack can be launched remotel...

CVE-2024-6942

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6943 ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization

A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserialization. The attack can be launched remotel...

CVE-2024-6943 ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization

A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserialization. The attack can be launched remotel...