CVE-2024-10500

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/policy/HookWhiteListService.java. The manipulation of the argument policyId leads to sql injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
ESAFENET	CDG	5
esafenet	cdg	5

References

https://flowus.cn/share/a582f7be-7e33-41f1-bce9-a1eb3578229f?code=G8A6P3Exploit, Third Party Advisory
https://vuldb.com/?ctiid.282440Permissions Required, VDB Entry
https://vuldb.com/?id.282440Third Party Advisory, VDB Entry
https://vuldb.com/?submit.427397Third Party Advisory, VDB Entry

Timeline

Published: Oct 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-105018.8A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet CVE-2024-105028.8A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of CVE-2024-105036.1A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing o CVE-2024-105045.4The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputt CVE-2024-105057.2A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe CVE-2024-105067.2A vulnerability classified as critical has been found in code-projects Blood Bank System 1.0. This affects an unknown part of the file /admi CVE-2024-105079.8A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknow CVE-2024-105089.8The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation v CVE-2024-105099.8A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects som CVE-2024-10516.4The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versio CVE-2024-105104.8The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which CVE-2024-105115.3CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo