CVE-2024-51319

CVE-2024-51319 : A local file inclusion in Zucchetti Ad Hoc Infinity 2.4’s /servlet/Report, exploited by uploading a JSP web/reverse shell through /jsp/zimg_upload.jsp, allows an authenticated attacker to achieve Remote Code Execution. The vulnerability is locally exploitable with LOW user intera...

CVE-2024-51321

CVE-2024-51321 affects Zucchetti Ad Hoc Infinity 2.4. The root cause is an improper check on the m_cURL parameter, which can allow an attacker to redirect an authenticated victim to an attacker-controlled website. Affected component: the authentication flow handling m_cURL in Zucchetti Ad Hoc Inf...

CVE-2024-51322

CVE-2024-51322 affects Zucchetti Ad Hoc Infinity 2.4. An authenticated attacker can achieve Remote Code Execution via multiple components: /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, and /jsp/gsmd_container.jsp. Root cause is a cross-site scripting vulnerability that enables ...

CVE-2024-51320

CVE-2024-51320 affects Zucchetti Ad Hoc Infinity 2.4. It is a cross-site scripting vulnerability that, when exploited by an authenticated attacker, can lead to Remote Code Execution via the endpoints /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile . The provided connected documents co...

CVE-2025-52180

Summary: CVE-2025-52180 is a cross-site scripting (XSS) flaw in Zucchetti Ad Hoc Infinity 4.2 and earlier. The issue arises from an unvalidated pHtmlSource parameter at the endpoint /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource, enabling remote, unauthenticated attackers to inject arbitrary JavaScrip...