CVE-2024-27746

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-277479.8File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the CVE-2024-27756.1A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affect CVE-2024-277525.4Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in th CVE-2024-277568.8GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.CVE-2024-277576.1flusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development as CVE-2024-277588.4In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(c CVE-2024-27766.5A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown fu CVE-2024-277635.3XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in t CVE-2024-277649.8An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.CVE-2024-277657.5Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplate CVE-2024-277665.7An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed b CVE-2024-277679.8CWE-287: Improper Authentication may allow Authentication Bypass