CVE-2024-41512

CADClick, a software solution for creating interactive 2D/3D CAD data catalogs, is vulnerable to a SQL Injection flaw in ccHandler.aspx affecting all versions v.1.11.0 and before . Remote attackers can exploit the "bomid" parameter to execute arbitrary SQL commands, potentially leading to unautho...

CVE-2024-41516

The software CADClick versions up to 1.11.0 is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the ccHandler.aspx component. The root cause is the improper neutralization of input via the bomid parameter, which allows remote attackers to inject arbitrary web script or HTML . This cou...

CVE-2024-41515

The CADClick software (versions

CVE-2024-41514

CADClick versions 1.11.0 and before are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the PrevPgGroup.aspx page. The root cause is the improper neutralization of input, allowing remote attackers to inject arbitrary web scripts or HTML via the wer parameter. This flaw c...

CVE-2024-41513

A reflected cross-site scripting (XSS) vulnerability exists in the Artikel.aspx component of CADClick version 1.11.0 and earlier. The root cause is the improper neutralization of input, which allows remote attackers to inject arbitrary web scripts or HTML via the searchindex parameter. This allow...

CVE-2024-41511

CADClick versions 1.11.0 and earlier are susceptible to a Path Traversal (Local File Inclusion) vulnerability within the "BinaryFileRedirector.ashx" component. This flaw allows remote attackers to retrieve arbitrary local files by manipulating the "path" parameter, potentially exposing sensitive ...

CVE-2025-25905

The software CADClick (versions 1.13.0 and earlier ) is vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the incorrect manipulation of the "tree" parameter , which allows remote attackers to inject arbitrary web scripts or HTML into the application. Impacted users may f...