CVE-2024-2941

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /adminpanel/admin/query/loginExe.php. The manipulation of the argument pass leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258032.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-294135.4Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the CVE-2024-294158.1The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, CVE-2024-294178.4Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password res CVE-2024-294195.4There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B202 CVE-2024-29426.5A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. This affects an unknown part of the CVE-2024-294216.2xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary c CVE-2024-29436.5A vulnerability has been found in Campcodes Online Examination System 1.0 and classified as critical. This vulnerability affects unknown cod CVE-2024-294329.8Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.CVE-2024-294339.8A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying cra CVE-2024-294348.3An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.CVE-2024-294354.1An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.CVE-2024-29446.5A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. This issue affects some unknown processing