CVE-2024-25521

CRITICAL Year: 2024
CVSS v3 Score
9.4
Critical
Weakness Type
CWE-89
View all →

Vulnerability Description

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.

Related Vulnerabilities

CVE-2016-5843

CRITICAL
CVSS:9.4(Critical)

Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL ...

CWE-892016

CVE-2019-16383

CRITICAL
CVSS:9.4(Critical)

MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. D...

CWE-892019

CVE-2022-22524

CRITICAL
CVSS:9.4(Critical)

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modif...

CWE-892022

CVE-2022-41271

CRITICAL
CVSS:9.4(Critical)

An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming ...

CWE-892022

CVE-2023-49581

CRITICAL
CVSS:9.4(Critical)

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauth...

CWE-892023

CVE-2024-25507

CRITICAL
CVSS:9.4(Critical)

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx.

CWE-892024