https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:31:59 +0000 https://cve.radiocsirt.org/vuln/cnvd-2024-21454 cnvd-2024-21454 https://cve.radiocsirt.org/vuln/cnvd-2024-21454 https://cve.radiocsirt.org/vuln/euvd-2026-196234 EUVD-2026-196234 https://cve.radiocsirt.org/vuln/euvd-2026-196234 https://cve.radiocsirt.org/vuln/fkie_cve-2024-24572 <p>facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.</p> <p>facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-24572 https://cve.radiocsirt.org/vuln/gsd-2024-24572 gsd-2024-24572 https://cve.radiocsirt.org/vuln/gsd-2024-24572