6 results (0.003 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-41516

https://notcve.org/view.php?id=CVE-2024-41516

04 Oct 2024 — A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "bomid" parameter. • http://cadclick.de • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-41512

https://notcve.org/view.php?id=CVE-2024-41512

04 Oct 2024 — A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via the "bomid" parameter. • http://cadclick.de • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-41515

https://notcve.org/view.php?id=CVE-2024-41515

04 Oct 2024 — A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "res_url" parameter. • http://cadclick.de • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-41511

https://notcve.org/view.php?id=CVE-2024-41511

04 Oct 2024 — A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrary local files via the "path" parameter. • https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-41514

https://notcve.org/view.php?id=CVE-2024-41514

04 Oct 2024 — A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "wer" parameter. • http://cadclick.de • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-41513

https://notcve.org/view.php?id=CVE-2024-41513

04 Oct 2024 — A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "searchindex" parameter. • http://cadclick.de • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •