CVE-2024-57408

The backend privilege management framework cool-admin-java v1.0 is vulnerable to an arbitrary file upload flaw in the /comm/upload component. This vulnerability allows an attacker to upload a specially crafted file, which can lead to arbitrary code execution . Currently, no patched version is rep...

CVE-2024-57409

A stored cross-site scripting (XSS) vulnerability exists in the Parameter List module of cool-admin-java v1.0 . Attackers can exploit this by injecting a crafted payload into the internet pictures field , leading to the execution of arbitrary web scripts or HTML. To mitigate this risk, it is reco...