CVE-2024-3357

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affects an unknown part of the file admin/mod_reports/index.php. The manipulation of the argument end leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259461 was assigned to this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Aplaya Beach Resort Online Reservation System	1.0
aplaya_beach_resort_online_reservation_system_project	aplaya_beach_resort_online_reservation_system	1.0

References

https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-11.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.259461Permissions Required, VDB Entry
https://vuldb.com/?id.259461Third Party Advisory, VDB Entry
https://vuldb.com/?submit.310226Third Party Advisory, VDB Entry
https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-11.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.259461Permissions Required, VDB Entry
https://vuldb.com/?id.259461Third Party Advisory, VDB Entry
https://vuldb.com/?submit.310226Third Party Advisory, VDB Entry

Timeline

Published: Apr 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-335708.8Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3.CVE-2024-335717.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-CVE-2024-335728.8Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.This issue affects Nexter Blocks: from n/a th CVE-2024-335734.3Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1.CVE-2024-335744.3Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.CVE-2024-335755.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a throu CVE-2024-335766.5Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.CVE-2024-335777.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain a stack overflow vulnerabil CVE-2024-335787.8A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges.CVE-2024-335797.8A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges.CVE-2024-33586.1A vulnerability classified as problematic was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This vulnerability CVE-2024-335807.8A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges.