CVE-2024-48259

The self-hosted PHP application Cloudlog version 2.6.15 is vulnerable to SQL injection due to unsanitized input in the Oqrs.php page's request_form function. Attackers can execute arbitrary SQL commands by sending a crafted request using the station_id or callsign parameters. This could lead to u...

CVE-2024-48253

Cloudlog 2.6.15 (self-hosted PHP app) is affected by an SQL injection in oqrs.php delete_oqrs_line via the id parameter. Root cause is unescaped/unsafely handled input in the delete_oqrs_line operation, leading to potential data disclosure, modification, or tampering. Tried and true impact is hig...

CVE-2024-48255

CVE-2024-48255 affects Cloudlog 2.6.15, where the Oqrs.php get_station_info endpoint is vulnerable to SQL injection via the station_id parameter. The issue enables unauthenticated network-level access with potential impact on confidentiality, integrity, and availability as indicated by the CVSS m...

CVE-2024-45999

Cloudlog 2.6.15 contains a SQL injection vulnerability in get_station_info() within /application/models/Oqrs_model.php, exploitable via the station_id parameter. Sources across Red Hat, NVD, OSV, CNNVD, and other feeds confirm the issue. The vulnerability is a SQL injection, enabling potential un...

CVE-2025-64084

Cloudlog versions 2.7.5 and earlier are susceptible to an authenticated SQL injection vulnerability. The root cause is the vucc_details_ajax function in application/controllers/Awards.php, which fails to properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenti...

CVE-2024-44065

A time-based blind SQL injection vulnerability exists in Cloudlog v2.6.15 , a self-hosted PHP application used for logging amateur radio contacts. The flaw is located at the /index.php/logbookadvanced/search endpoint within the qsoresults parameter. This vulnerability allows an attacker to execut...