CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 4CVE-2024-2076 – CodeAstro House Rental Management System tenant.php missing authentication
https://notcve.org/view.php?id=CVE-2024-2076
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file booking.php/owner.php/tenant.php. The manipulation leads to missing authentication. The attack may be launched remotely. • https://github.com/yoryio/CVE-2024-20767 https://github.com/Chocapikk/CVE-2024-20767 https://github.com/Praison001/CVE-2024-20767-Adobe-ColdFusion https://docs.qq.com/doc/DYlREVXpuRUFwRFpQ https://vuldb.com/?ctiid.255392 https://vuldb.com/?id.255392 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1825 – CodeAstro House Rental Management System User Registration Page cross site scripting
https://notcve.org/view.php?id=CVE-2024-1825
A vulnerability, which was classified as problematic, was found in CodeAstro House Rental Management System 1.0. This affects an unknown part of the component User Registration Page. The manipulation of the argument address with the input <img src="1" onerror="console.log(1)"> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://docs.qq.com/doc/DYndSY3V4UXh4dHFC https://vuldb.com/?ctiid.254613 https://vuldb.com/?id.254613 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1824 – CodeAstro House Rental Management System signing.php sql injection
https://notcve.org/view.php?id=CVE-2024-1824
A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file signing.php. The manipulation of the argument uname/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://docs.qq.com/doc/DYk9QcHVFRENObWtj https://vuldb.com/?ctiid.254612 https://vuldb.com/?id.254612 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •