CVE-2024-42779

CVE-2024-42779 concerns Kashipara Music Management System v1.0. Affected component: the endpoint /music/ajax.php?action=save_music handles file uploads. Root cause: unrestricted file upload allows uploading a crafted PHP file, enabling arbitrary code execution on the server. Documented impact: re...

CVE-2024-42778

CVE-2024-42778 affects Kashipara Music Management System v1.0. The vulnerability is an Unrestricted file upload in /music/ajax.php?action=save_playlist that enables uploading a crafted PHP file to execute arbitrary code on the server. Public sources describe lack of validation/secure handling for...

CVE-2024-42783

Kashipara Music Management System v1.0 is affected by a SQL Injection via the pid parameter in /music/manage_playlist_items.php, caused by lack of input validation. The vulnerability allows an attacker to execute arbitrary SQL commands, leading to potential data disclosure/modification and other ...

CVE-2024-42781

Kashipara Music Management System v1.0 suffers from a SQL injection in /music/ajax.php?action=login via the email parameter, enabling remote attackers to execute arbitrary SQL and bypass login. Documented details indicate a high-severity issue with potential data exposure and authentication bypas...

CVE-2024-42788

CVE-2024-42788 — Kashipara Music Management System v1.0 has a stored XSS flaw in the endpoint /music/ajax.php?action=save_music, allowing an attacker to inject via the title and artist parameters. The vulnerability’s impact is described as the ability to execute arbitrary code in the context of t...

CVE-2024-42780

Kashipara Music Management System v1.0 is vulnerable to an Unrestricted file upload at /music/ajax.php?action=save_genre (endpoint may also be referenced as /music/ajax.php?action=save genre). A crafted PHP file upload can lead to remote code execution due to lack of input/file validation. Impact...

CVE-2024-42782

Kashipara Music Management System v1.0 contains a SQL injection in the endpoint /music/ajax.php?action=find_music (parameter: search). The vulnerability allows an attacker to execute arbitrary SQL commands, potentially exposing or altering database data. Affected component is the find_music/searc...

CVE-2024-42786

Affected software/version: Kashipara Music Management System v1.0. Component/endpoint: /music/view_user.php (View User Profile Page) vulnerable via the id parameter. Root cause: lack of validation/external SQL input leading to SQL injection. Impact: attacker can execute arbitrary SQL commands, po...

CVE-2024-42796

CVE-2024-42796 affects Kashipara Music Management System v1.0. The issue is an Incorrect Access Control in the /music/ajax.php?action=delete_genre endpoint, allowing an unauthenticated attacker to delete valid music genre entries. Exploitation details are not provided in the available documents. ...

CVE-2024-42784

CVE-2024-42784 : A SQL injection exists in Kashipara Music Management System v1.0, exploitable through the endpoint /music/controller.php?page=view_music via the id parameter. The vulnerability could allow the attacker to execute arbitrary SQL commands, potentially exposing or manipulating databa...

CVE-2024-42785

Kashipara Music Management System v1.0 contains a SQL injection in /music/index.php?page=view_playlist via the id parameter. The issue stems from lack of input validation, enabling an attacker to execute arbitrary SQL commands. This impacts confidentiality, integrity, and availability per the CVE...

CVE-2024-42791

CVE-2024-42791 affects Kashipara Music Management System v1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the /music/ajax.php?action=delete_genre endpoint, enabling unauthorized actions if a victim is induced to perform the request. CVSS v3.1 metrics indicate AV:N/AC:L/PR:N/UI:R/...

CVE-2024-42795

Kashipara Music Management System v1.0 contains an Incorrect Access Control flaw exposed via /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3, allowing an unauthenticated attacker to view valid user details. This aligns with CVE-2024-42795. Affected components are the view_...

CVE-2024-42777

Kashipara Music Management System v1.0 contains an Unrestricted file upload vulnerability at /music/ajax.php?action=signup that allows attackers to upload a crafted PHP file and execute arbitrary code. Root cause: lack of validation/constraints on uploaded files enabling remote code execution. Af...

CVE-2024-42789

Kashipara Music Management System v1.0 is affected by a Reflected XSS in /music/controller.php?page=test. The vulnerability arises from insufficient input validation/escaping of the page parameter, allowing remote attackers to inject scripts and potentially execute arbitrary code in the user's br...

CVE-2024-42790

CVE-2024-42790 describes a Reflected XSS in Kashipara Music Management System v1.0 affecting /music/index.php?page=test via the page parameter. The issue stems from insufficient input handling/escaping, enabling remote attackers to inject scripts and potentially run code in the victim’s context. ...

CVE-2024-42798

Kashipara Music Management System v1.0 contains an Incorrect Access Control vulnerability affecting /music/index.php?page=user_list and /music/index.php?page=edit_user. The weakness could allow a low-privilege attacker to take over the administrator account. Root cause: access-control error. Publ...

CVE-2024-42792

Kashipara Music Management System v1.0 is affected by a Cross-Site Request Forgery (CSRF) via /music/ajax.php?action=delete_playlist. The vulnerability allows an attacker to induce a user to perform a sensitive action, with the request crafted to spoof legitimate operations. Root cause: CSRF on t...

CVE-2024-42794

Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control in the /music/ajax.php?action=save_user endpoint. The root cause is an access-control flaw that may allow unauthorized actions via the save_user function, potentially enabling account-related manipulation. Public ref...

CVE-2024-42787

CVE-2024-42787 is a Stored XSS in Kashipara Music Management System v1.0, exploitable via /music/ajax.php?action=save_playlist through the title/description fields. Public docs indicate lack of input filtering/escaping, allowing arbitrary script execution. No explicit exploit details are provided...

CVE-2024-42797

CVE-2024-42797 affects Kashipara Music Management System v1.0. Affects the endpoint /music/ajax.php?action=delete_playlist where an Incorrect Access Control flaw allows an unauthenticated attacker to delete valid music playlist entries. Documents do not provide a patch version or explicit remedia...

CVE-2024-42793

CVE-2024-42793 affects Kashipara Music Management System v1.0. A CSRF vulnerability exists via a crafted request to /music/ajax.php?action=save_user, due to insufficient verification of the request origin. Impact is described as enabling forged malicious requests to perform sensitive operations; ...