CVE-2024-3140

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file /classes/Users.php?f=save. The manipulation of the argument middlename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258915.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Computer Laboratory Management System	1.0
sourcecodester	computer_laboratory_management_system	1.0

References

https://github.com/Sospiro014/zday1/blob/main/xss_1.mdExploit
https://vuldb.com/?ctiid.258915Permissions Required
https://vuldb.com/?id.258915Third Party Advisory
https://vuldb.com/?submit.308214Third Party Advisory
https://github.com/Sospiro014/zday1/blob/main/xss_1.mdExploit
https://vuldb.com/?ctiid.258915Permissions Required
https://vuldb.com/?id.258915Third Party Advisory
https://vuldb.com/?submit.308214Third Party Advisory

Timeline

Published: Apr 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-314006.5Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, uninten CVE-2024-314019.0Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege CVE-2024-314024.3Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared T CVE-2024-314035.4Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data CVE-2024-314044.3Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the CVE-2024-314068.8Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticat CVE-2024-314076.7Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before v CVE-2024-314088.0OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbi CVE-2024-314097.5Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from througho CVE-2024-31412.4A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This vulnerability affects unknown cod CVE-2024-314106.5The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attac CVE-2024-314118.8Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that