CVE-2024-2478

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-247809.8Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register mal CVE-2024-247817.5An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive CVE-2024-247824.3An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the CVE-2024-247835.9Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This CVE-2024-247847.5The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with CVE-2024-247855.4If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of CVE-2024-247867.5The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when u CVE-2024-247876.4On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of CVE-2024-247885.9A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.CVE-2024-247895.5The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalig CVE-2024-24793.5A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Ca CVE-2024-247909.8The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses w