CVE-2024-57408

The backend privilege management framework cool-admin-java v1.0 is affected by an arbitrary file upload vulnerability in the /comm/upload component. An attacker can upload a specially crafted file to achieve arbitrary code execution . To mitigate this risk, it is recommended to disable the /comm/...

CVE-2024-57409

A stored cross-site scripting (XSS) vulnerability exists in the Parameter List module of cool-admin-java v1.0 . Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the internet pictures field . To mitigate this risk, it is recommended to disable the Parameter L...