Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-53635 |
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the searchdata POST request parameter.
EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-53604 |
Description: A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the mobnumber POST request parameter.
EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-53603 |
Description: A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.
EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-53597 |
|
|
CVE-2024-53556 |
|
|
CVE-2024-53438 |
Description: EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-53264 |
Description: bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS: MEDIUM (5.1) EPSS Score: 0.06%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-53260 |
Description: Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid excel / spreadsheet formula. When an instructor downloads their course's roster and opens, this name will then be evaluated as a formula. This could lead to leakage of information of students in the course roster by sending the data to a remote endpoint. This issue has been patched in the source code repository and the fix is expected to be released in the next version. Users are advised to manually patch their systems or to wait for the next release. There are no known workarounds for this vulnerability.
CVSS: MEDIUM (6.8) EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-52959 |
Description: A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.
CVSS: CRITICAL (9.3) EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|
|
CVE-2024-52958 |
Description: A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.
CVSS: CRITICAL (9.3) EPSS Score: 0.04%
November 28th, 2024 (6 months ago)
|