Total
398466 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-24389 | 1 Xunruicms | 1 Xunruicms | 2026-06-17 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Column Name parameter. | |||||
| CVE-2024-24388 | 1 Xunruicms | 1 Xunruicms | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login. | |||||
| CVE-2024-24386 | 1 Vitalpbx | 1 Vitalpbx | 2026-06-17 | N/A | 7.2 HIGH |
| An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder. | |||||
| CVE-2024-24377 | 1 Idocv | 1 Idocview | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script. | |||||
| CVE-2024-24375 | 1 Jfinalcms Project | 1 Jfinalcms | 2026-06-17 | N/A | 7.5 HIGH |
| SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. | |||||
| CVE-2024-24350 | 1 Softwarepublico | 1 E-sic Livre | 2026-06-17 | N/A | 8.8 HIGH |
| File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering component. | |||||
| CVE-2024-24337 | 1 Koha | 1 Koha | 2026-06-17 | N/A | 8.0 HIGH |
| CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components. | |||||
| CVE-2024-24336 | 2026-06-17 | N/A | 8.1 HIGH | ||
| A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and passwords of users visiting the affected page, via the 'Circulation note' and ‘Patrons Restriction’ components. | |||||
| CVE-2024-24335 | 1 Rt-thread | 1 Rt-thread | 2026-06-17 | N/A | 8.4 HIGH |
| A heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2. | |||||
| CVE-2024-24334 | 1 Rt-thread | 1 Rt-thread | 2026-06-17 | N/A | 8.4 HIGH |
| A heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2. | |||||
| CVE-2024-24333 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function. | |||||
| CVE-2024-24332 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function. | |||||
| CVE-2024-24331 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function. | |||||
| CVE-2024-24330 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg function. | |||||
| CVE-2024-24329 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function. | |||||
| CVE-2024-24328 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. | |||||
| CVE-2024-24327 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function. | |||||
| CVE-2024-24326 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules function. | |||||
| CVE-2024-24325 | 1 Totolink | 2 A3300r, A3300r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function. | |||||
| CVE-2024-24324 | 1 Totolink | 2 A8000ru, A8000ru Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow. | |||||