CVE-2024-51319

The ERP software Zucchetti Ad Hoc Infinity version 2.4 contains a local file include vulnerability within the /servlet/Report component. This flaw allows an authenticated attacker to achieve Remote Code Execution (RCE) by uploading a JSP web/reverse shell via the /jsp/zimg_upload.jsp endpoint. A ...

CVE-2024-51321

In Zucchetti Ad Hoc Infinity version 2.4 , an improper check on the m_cURL parameter allows an attacker to perform an Open Redirect (CWE-601). This vulnerability enables an attacker to redirect a victim to an attacker-controlled website following a successful authentication. To mitigate this risk...

CVE-2024-51322

A Cross Site Scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Infinity version 2.4 . This flaw allows an authenticated attacker to achieve Remote Code Execution (RCE) by targeting specific components, including /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, and /jsp/gsmd...

CVE-2024-51320

A Cross Site Scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Infinity version 2.4 , an ERP software. The flaw is located in the /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile components. An authenticated attacker can exploit this vulnerability to achieve Remote Code Executio...

CVE-2025-52180

A Cross-site scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Infinity versions 4.2 and earlier . The flaw stems from an unvalidated pHtmlSource parameter within the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint. This allows remote unauthenticated attackers to inject arbitrary JavaSc...