CVE-2024-6743

AguardNet Space Management System - SQL injection

AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Space Management System Project

Products

Space Management System

CVE-2024-6742

AguardNet Space Management System - Reflected Cross-Site Scripting

AguardNet Technology's Space Management System does not properly filter user input, allowing remote attackers with regular privileges to inject JavaScript and perform Reflected Cross-site scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Space Management System Project

Products

Space Management System

CVE-2024-6741

Openfind Mail2000 - HttpOnly flag bypass

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openfind

Products

Mail2000

CVE-2024-6740

Openfind Mail2000 - Stored XSS

Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openfind

Products

Mail2000

CVE-2024-6739

Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag

The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openfind

Products

Mailaudit Mailgates

CVE-2024-6738

WisdomGarden Tronclass - Broken Access Control

The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wisdomgarden

Products

Tronclass

CVE-2024-6737

2100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control

The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Electronic Official Document Management System Project

Products

Electronic Official Document Management System

CVE-2024-6736

SourceCodester Employee and Visitor Gate Pass Logging System view_employee.php sql injection

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file view_employee.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271457 was assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Employee And Visitor Gate Pass Logging System

CVE-2024-6735

itsourcecode Tailoring Management System setgeneral.php sql injection

A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file setgeneral.php. The manipulation of the argument sitename/email/mobile/sms/currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271456.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Angeljudesuarez

Products

Tailoring Management System

CVE-2024-6734

itsourcecode Tailoring Management System templateadd.php sql injection

A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file templateadd.php. The manipulation of the argument title/msg leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271455.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Angeljudesuarez

Products

Tailoring Management System

CVE-2024-6733

itsourcecode Tailoring Management System templateedit.php sql injection

A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file templateedit.php. The manipulation of the argument id/title/msg leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271454 is the identifier assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Angeljudesuarez

Products

Tailoring Management System

CVE-2024-6732

SourceCodester Student Study Center Desk Management System Users.php sql injection

A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. This vulnerability affects unknown code of the file /sscdms/classes/Users.php?f=save. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Student Study Center Desk Management System

CVE-2024-6731

SourceCodester Student Study Center Desk Management System Master.php sql injection

A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. This affects an unknown part of the file /Master.php?f=save_student. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Student Study Center Desk Management System

CVE-2024-6729

SourceCodester Kortex Lite Advocate Office Management System add_act.php sql injection

A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /control/add_act.php. The manipulation of the argument aname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Advocate Office Management System

CVE-2024-6728

itsourcecode Tailoring Management System typeedit.php sql injection

A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file typeedit.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271401 was assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Angeljudesuarez

Products

Tailoring Management System

CVE-2024-6707

Open WebUI Arbitrary File Upload + Path Traversal

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Debian Openwebui

Products

Debian Linux Open Webui

CVE-2024-6706

Open WebUI Stored Cross-Site Scripting

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Openwebui

Products

Debian Linux Open Webui

CVE-2024-6678

Authentication Bypass by Spoofing in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.

CVSS 3.1 · 9.9 Critical EPSS 2.0% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2024-6650

SourceCodester Employee and Visitor Gate Pass Logging System Master.php save_designation cross site scripting

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the function save_designation of the file /classes/Master.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271058 is the identifier assigned to this vulnerability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Employee And Visitor Gate Pass Logging System

CVE-2024-6649

SourceCodester Employee and Visitor Gate Pass Logging System Users.php save_users cross-site request forgery

A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is the function save_users of the file Users.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271057 was assigned to this vulnerability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Employee And Visitor Gate Pass Logging System