CVE-2024-11956

MEDIUM Year: 2024
CVSS v3 Score
4.7
Medium
CVSS v2 Score
5.8
Medium
Weakness Type
CWE-74
View all →

Vulnerability Description

A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.

Related Vulnerabilities

CVE-2018-1474

MEDIUM
CVSS:4.7(Medium)

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit t...

CWE-742018

CVE-2020-15187

MEDIUM
CVSS:4.7(Medium)

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an at...

CWE-742020

CVE-2020-4027

MEDIUM
CVSS:4.7(Medium)

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vuln...

CWE-742020

CVE-2023-30609

MEDIUM
CVSS:4.7(Medium)

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search resu...

CWE-742023

CVE-2024-28234

MEDIUM
CVSS:4.7(Medium)

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are onl...

CWE-742024

CVE-2025-1611

MEDIUM
CVSS:4.7(Medium)

A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. Th...

CWE-742025