CVE-2024-11968

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Farmacia up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file pagamento.php. The manipulation of the argument notaFiscal leads to sql injection. The attack can be launched remotely.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Farmacia	1.0
code-projects	farmacia	1.0

References

https://code-projects.org/Product
https://github.com/xiaobai19198/cve/blob/main/sql-cve.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.286351Permissions Required
https://vuldb.com/?id.286351Third Party Advisory
https://vuldb.com/?submit.452877Third Party Advisory

Timeline

Published: Nov 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-119698.8The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-ad CVE-2024-11979.8A vulnerability, which was classified as critical, has been found in SourceCodester Testimonial Page Manager 1.0. This issue affects some un CVE-2024-119709.8A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function o CVE-2024-119715.4A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown CVE-2024-119729.8The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to CVE-2024-119736.1The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' param CVE-2024-119746.1The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-CVE-2024-119756.1The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' paramet CVE-2024-119767.3The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is CVE-2024-119777.3The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers CVE-2024-119787.5DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to rea CVE-2024-119799.8DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated