CVE-2024-11016

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Grand Vice info	Webopac	>= 6, < 6.5.1; >= 7, < 7.2.3
vice	webopac	>= 6.0, < 6.5.1; >= 7.0, < 7.2.3

References

https://www.twcert.org.tw/en/cp-139-8210-46322-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8209-bf75d-1.htmlThird Party Advisory

Timeline

Published: Nov 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-110178.8Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and CVE-2024-110189.8Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute CVE-2024-110196.1Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitr CVE-2024-11026.5A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and pas CVE-2024-110209.8Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to CVE-2024-110215.4Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary Ja CVE-2024-110225.6The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This ch CVE-2024-110236.1Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for s CVE-2024-110249.8The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,CVE-2024-110255.4An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain re CVE-2024-110267.4A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is so CVE-2024-110289.8The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up