rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-56897 
Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2024-56898 
Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-56901 
A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-56902 
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-56903 
Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-56908 
In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directories of their choice, potentially leading to remote code execution or server compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2024-56914 
D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-22T00:00:00.000Z
CVE-2024-56915 
Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-26T00:00:00.000Z
CVE-2024-56916 
In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-24T00:00:00.000Z
CVE-2024-56917 
Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-24T00:00:00.000Z
CVE-2024-56918 
In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-24T00:00:00.000Z
CVE-2024-56921 
An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_state_exception() function upon receipt of the Nausf_UEAuthentication_Authenticate response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-56923 
Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-22T00:00:00.000Z
CVE-2024-56924 
A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page (pages_account), potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information. This vulnerability occurs due to improper validation of user requests, which enables attackers to exploit the system by tricking the admin user into executing malicious scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-22T00:00:00.000Z
CVE-2024-56938 
LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2024-56939 
LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2024-56940 
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2024-56946 
Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC connections by triggering unhandled exceptions in listener threads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2025-02-03T00:00:00.000Z
CVE-2024-56947 
An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56948 
An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56949 
An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56950 
An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56951 
An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56952 
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56953 
An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56954 
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56955 
An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56957 
An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56959 
An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56960 
An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56962 
An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56963 
An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56964 
An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56965 
An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56966 
An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56967 
An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56968 
An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56969 
An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56971 
An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56972 
An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-56973 
Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the ProcessUploadFromURL.jsp component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2024-56975 
InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2024-56990 
PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-56997 
PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-56998 
PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-57004 
Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-57011 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57012 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57013 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57014 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57015 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57016 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57017 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57018 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57019 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57020 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57021 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57022 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57023 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57024 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57025 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-57026 
TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2024-57030 
Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-57031 
WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-57032 
WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is possible to change the password by placing any value in the senha_antiga field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-57033 
WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-57034 
WeGIA < 3.2.0 is vulnerable to SQL Injection in query_geracao_auto.php via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-57035 
WeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-57036 
TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-57040 
TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical access to the router. NOTE: The supplier has stated that this issue was fixed in firmware versions 250401 or later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2024-57041 
A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-24T00:00:00.000Z
CVE-2024-57045 
A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2024-57046 
A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the the requested url, it will be recognized as passing the authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2024-57049 
A vulnerability in the TP-Link Archer c20 router with firmware version V6.6_230412 and earlier permits unauthorized individuals to bypass the authentication of some interfaces under the /cgi directory. When adding Referer: http://tplinkwifi.net to the the request, it will be recognized as passing the authentication. NOTE: this is disputed by the Supplier because the response to the API call is only "non-sensitive UI initialization variables."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2024-57052 
An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-57055 
Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the necessary access level. This issue is limited to services used by the client (not the general-use JSON services) and requires reverse engineering of the proprietary serialization protocol, making it difficult to exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z