PT-2024-9131 · Tenda · Tenda Rx9 +1

Name of the Vulnerable Software and Affected Versions: Tenda RX9 and RX9 Pro versions 22.03.02.10 through 22.03.02.20 Description: The issue is related to a stack-based buffer overflow in the sub 42EA38 function, which can be exploited by sending a specially crafted POST request to the...

PT-2024-16158 · Unknown · Localserver

Name of the Vulnerable Software and Affected Versions: LocalServer version 1.0.9 Description: A Cross-Site Scripting XSS issue allows a remote user to send a specially crafted query to an authenticated user and steal their session details. This is achieved through the "/testmail/index.php" API...

PT-2024-6717

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Expedition affected versions not specified Description: The issue is related to an SQL injection vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to reveal Expedition...

PT-2024-31702

Name of the Vulnerable Software and Affected Versions: Mesop versions prior to 0.12.4 Description: A vulnerability has been discovered in Mesop, a Python-based UI framework, that could potentially allow unauthorized access to files on the server hosting the Mesop application. The issue is related...

Exploit for CVE-2024-55271

Gym Management System CVE-2024-55271 A GYM management sys...

PT-2024-38842 · Unknown · Continew Admin

Name of the Vulnerable Software and Affected Versions: ContiNew Admin version 3.2.0 Description: A critical vulnerability was found in ContiNew Admin, affecting the function top.continew.starter.extension.crud.controller.BaseControllertree of the file...

PT-2024-38551 · Wanglongcn · Ltcms

Name of the Vulnerable Software and Affected Versions: wanglongcn ltcms version 1.0.20 Description: A critical issue has been found, affecting the downloadUrl function of the /api/file/downloadUrl API Endpoint. The manipulation of the file argument leads to server-side request forgery, which can ...

PT-2024-38124 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS versions 12.9 through 13.0 Description: A problematic issue has been found in some unknown functionality of the file "js/player/dmplayer/admin/post.php?act=setting". The manipulation of the yzm argument leads to cross site scripting. T...

PT-2024-38006 · Sourcecodester · Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: A critical issue has been found in the system, affecting the file /employee gatepass/admin/?page=employee/manage employee. The manipulation of the id argume...

SQL Injection

com.jfinal, jfinal is vulnerable to SQL injection. The vulnerability is due to improper input validation in the DivDataControllerdata method, allowing attackers to execute arbitrary SQL commands by manipulating the tableName field of a custom div object. Attackers can exploit this flaw by creatin...

PT-2024-27799 · Unknown · Learning Management System Project In Php With Source Code

Name of the Vulnerable Software and Affected Versions: Learning Management System Project In PHP With Source Code version 1.0 Description: The issue allows attackers to execute arbitrary SQL commands via the id parameter in the processscore.php file. This can lead to unauthorized access and...

PT-2024-28299 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: netbox version 4.0.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at "/dcim/power-ports/add/". Recommendations: For netbox versi...

Poultry Farm Management System v1.0 - Remote Code Execution (RCE)

Exploit Title: Poultry Farm Management System v1.0 - Remote Code Execution RCE Date: 24-06-2024 CVE: N/A Awaiting ID to be assigned Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html Software Link:...

Poultry Farm Management System 1.0 Shell Upload

Exploit Title: Poultry Farm Management System v1.0 - Remote Code Execution RCE Date: 24-06-2024 CVE: N/A Awaiting ID to be assigned Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html Software Link:...

PT-2024-25492 · Unknown · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: campcodes Complete Web-Based School Management System version 1.0 Description: A SQL injection issue allows an attacker to execute arbitrary SQL commands via the id parameter in the "/model/get student.php" API endpoint. Recommendations: For...

GHSA-J74Q-MV2C-RXMP Umbraco CMS Open Redirect Bypass Protection

Impact Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed. Affected Version = 8.18.5, = 10.5.0, = 12.0.0, = 13.0.0 Patches 8.18.14, 10.8.6, 12.3.10, 13.3.1...

CVE-2024-4322

The CVE-2024-4322 issue affects parisneo/lollms-webui, specifically the /list_personalities endpoint. The vulnerability arises from improper handling of user-controlled input in the category parameter, enabling path traversal to list arbitrary directories on the host. Reports across multiple sour...

PT-2024-33750 · Siadmin · Siadmin

Name of the Vulnerable Software and Affected Versions: SiAdmin version 1.1 Description: The issue allows SQL injection via the "/modul/mod pass/aksi pass.php" parameter in nama lengkap. This could enable a remote attacker to send a specially crafted SQL query to the system and retrieve all the...

Exploit for SQL Injection in Storeapps Smart_Manager

CVE-2024-0566 Smart Manager 8.27.0 - Post-Authenticated SQL In...

GHSA-5XV3-FM7G-865R OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)

SpEL Injection in GET /api/v1/policies/validation/condition/ GHSL-2023-236 Please note, only authenticated users have access to PUT / POST APIS for /api/v1/policies. Non authenticated users will not be able to access these APIs to exploit the vulnerability. A user must exist in OpenMetadata and...