deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-38289
Published: 2024-07-25
Description: A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42v; https://www.rhubcom.com/v5/manuals.html; https://github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42v
CVE: CVE-2024-40324
Published: 2024-07-25
Description: A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP response splitting and header manipulation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74, CWE-93, CWE-113
References: https://github.com/aleksey-vi/CVE-2024-40324; https://github.com/aleksey-vi/CVE-2024-40324
CVE: CVE-2024-41808
Published: 2024-07-25
Description: The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. It has been noted that the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain areas of the front end lack this XSS protection. When combining the missing protection with the insecure authentication handling that the front-end uses, a malicious user may be able to take over any victim's account provided they meet the exploitation steps. As of time of publication, no patched version is available.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/openobserve/openobserve/security/advisories/GHSA-hx23-g7m8-h76j; https://github.com/openobserve/openobserve/security/advisories/GHSA-hx23-g7m8-h76j
CVE: CVE-2024-6558
Published: 2024-07-25
Description: HMS Industrial Networks

Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is possible to insert HTML code into input fields and store the HTML code. The stored HTML code will be embedded in the page and executed by host browser the next time the page is loaded, enabling social engineering attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-05-17-001---anybus---compactcom-30-xss.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-20; https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-05-17-001---anybus---compactcom-30-xss.pdf
CVE: CVE-2024-41809
Published: 2024-07-25
Description: OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32; https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02; https://github.com/openobserve/openobserve/commit/[PII_REDACTED]8217dfb8af4c4f6054d58bbc6d331d
CVE: CVE-2024-7105
Published: 2024-07-25
Description: A vulnerability classified as critical has been found in ForIP Tecnologia Administração PABX 1.x. Affected is an unknown function of the file /detalheIdUra of the component Lista Ura Page. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://docs.google.com/document/d/1Q3kLR-HXSmj1LFpnCAt964YHACWwdckz4O8n4ocgB1I/edit?usp=sharing; https://vuldb.com/?ctiid.272430; https://vuldb.com/?id.272430
CVE: CVE-2024-7106
Published: 2024-07-25
Description: A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_folders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272431. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/topsky979/Security-Collections/blob/main/cve3/README.md; https://vuldb.com/?ctiid.272431; https://vuldb.com/?id.272431
CVE: CVE-2024-24621
Published: 2024-07-25
Description: Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697, CWE-697
References: https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass/; https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass/
CVE: CVE-2024-24622
Published: 2024-07-25
Description: Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://blog.exodusintel.com/2024/07/24/softaculous-webuzo-password-reset-command-injection/; https://blog.exodusintel.com/2024/07/24/softaculous-webuzo-password-reset-command-injection/
CVE: CVE-2024-24623
Published: 2024-07-25
Description: Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-ftp-management-command-injection/; https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-ftp-management-command-injection/
CVE: CVE-2024-38103
Published: 2024-07-25
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-359
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38103; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38103
CVE: CVE-2024-3938
Published: 2024-07-25
Description: The "reset password" login page accepted an HTML injection via URL parameters.

This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a  http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E 

This will result in a view along these lines:





  *  OWASP Top 10 - A03: Injection
  *  CVSS Score: 5.4
  *   AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator 
  *   https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://www.dotcms.com/security/SI-71; https://www.dotcms.com/security/SI-71
CVE: CVE-2024-41468
Published: 2024-07-25
Description: Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-94
References: https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/exeCommand/README.md; https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/exeCommand/README.md
CVE: CVE-2024-41473
Published: 2024-07-25
Description: Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/WriteFacMac; https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/WriteFacMac
CVE: CVE-2024-4447
Published: 2024-07-26
Description: In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack this privilege would still be able to utilize the session IDs to imitate other users.


While this is a very small attack vector that requires very high permissions to execute, its danger lies principally in obfuscating attribution; all Sign In As operations are attributed appropriately in the log files, and a malicious administrator could use this information to render their dealings untraceable — including those admins who have not been granted this ability — such as by using a session ID to generate an API token.

Fixed in: 24.07.12 / 23.01.20 LTS / 23.10.24v13 LTS / 24.04.24v5 LTS

This was the original found by researcher Zakaria Agharghar.




2. Later, on October 20, 2025, another researcher (Chris O’Neill) found additional affected DWR Endpoints that are vulnerable to Information Disclosure, namely and in addition to the original found of "UserSessionAjax.getSessionList.dwr - Session ID exposure":



  *  UserAjax.getUsersList.dwr - Enumerate all users with IDs, names, emails

  *  RoleAjax.getUserRole.dwr - Get user role information

  *  RoleAjax.getRole.dwr - Get role details

  *  RoleAjax.getRolePermissions.dwr - View role permissions

  *  RoleAjax.isPermissionableInheriting.dwr - Check permission inheritance

  *  RoleAjax.getCurrentCascadePermissionsJobs.dwr - View permission cascade jobs

  *  ThreadMonitorTool.getThreads.dwr - Monitor system threads; and,

  *  CRITICAL - Privilege Escalation: RoleAjax.saveRolePermission.dwr - Modify role permissions


Overall CVSS for the above findings:



  *   CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L 

  *  Score: 9.1 (Critical)
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-863
References: https://www.dotcms.com/security/SI-72; https://www.dotcms.com/security/SI-72
CVE: CVE-2024-7114
Published: 2024-07-26
Description: A vulnerability was found in Tianchoy Blog up to 1.8.8. It has been classified as critical. This affects an unknown part of the file /so.php. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272445 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/topsky979/Security-Collections/tree/main/cve5; https://vuldb.com/?ctiid.272445; https://vuldb.com/?id.272445
CVE: CVE-2024-7115
Published: 2024-07-26
Description: A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been declared as critical. This vulnerability affects unknown code of the file /designation_viewmore.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272446 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/topsky979/Security-Collections/tree/main/cve6; https://vuldb.com/?ctiid.272446; https://vuldb.com/?id.272446
CVE: CVE-2024-7116
Published: 2024-07-26
Description: A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been rated as critical. This issue affects some unknown processing of the file /branch_viewmore.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-272447. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/topsky979/Security-Collections/tree/main/cve7; https://vuldb.com/?ctiid.272447; https://vuldb.com/?id.272447
CVE: CVE-2024-7117
Published: 2024-07-26
Description: A vulnerability classified as critical has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected is an unknown function of the file /shift_viewmore.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-272448. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/topsky979/Security-Collections/tree/main/cve8; https://vuldb.com/?ctiid.272448; https://vuldb.com/?id.272448
CVE: CVE-2024-7118
Published: 2024-07-26
Description: A vulnerability classified as critical was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this vulnerability is an unknown functionality of the file /department_viewmore.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier VDB-272449 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/topsky979/Security-Collections/tree/main/cve9; https://vuldb.com/?ctiid.272449; https://vuldb.com/?id.272449
CVE: CVE-2023-49921
Published: 2024-07-26
Description: An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179; https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179
CVE: CVE-2024-7119
Published: 2024-07-26
Description: A vulnerability, which was classified as critical, has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this issue is some unknown functionality of the file /employee_viewmore.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272450 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/topsky979/Security-Collections/tree/main/cve10; https://vuldb.com/?ctiid.272450; https://vuldb.com/?id.272450
CVE: CVE-2024-7120
Published: 2024-07-26
Description: A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://netsecfish.notion.site/Command-Injection-Vulnerability-in-RAISECOM-Gateway-Devices-673bc7d2f8db499f9de7182d4706c707?pvs=4; https://vuldb.com/?ctiid.272451; https://vuldb.com/?id.272451
CVE: CVE-2024-40897
Published: 2024-07-26
Description: Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-121
References: http://www.openwall.com/lists/oss-security/2024/07/26/1; https://github.com/GStreamer/orc; https://gstreamer.freedesktop.org/modules/orc.html
CVE: CVE-2024-6490
Published: 2024-07-26
Description: During testing of the Master Slider  WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider  WordPress plugin through 3.9.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5a56e5aa-841d-4be5-84da-4c3b7602f053/; https://wpscan.com/vulnerability/5a56e5aa-841d-4be5-84da-4c3b7602f053/
CVE: CVE-2024-25090
Published: 2024-07-26
Description: Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.

This issue affects Apache Roller: from 5.0.0 before 6.1.3.

Users are recommended to upgrade to version 6.1.3, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd; http://www.openwall.com/lists/oss-security/2024/07/25/2; https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd
CVE: CVE-2023-38522
Published: 2024-07-26
Description: Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.

Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444, CWE-444
References: https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0; https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0; https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html
CVE: CVE-2024-35161
Published: 2024-07-26
Description: Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.

Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444, CWE-444
References: https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0; https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0; https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html
CVE: CVE-2024-35296
Published: 2024-07-26
Description: Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.

Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0; https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0; https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html
CVE: CVE-2024-41684
Published: 2024-07-26
Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to capture cookies and compromise the targeted system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-614
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225; https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE: CVE-2024-41685
Published: 2024-07-26
Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1004, CWE-732
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225; https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE: CVE-2024-41686
Published: 2024-07-26
Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by creating password that do not adhere to the defined security standards/policy on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to expose the router to potential security threats.
CVSS Score: 3.3 (LOW)
CWE: CWE-179
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225; https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225