CVE-2024-3358

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument to leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259462 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Aplaya Beach Resort Online Reservation System	1.0
sourcecodester	aplaya_beach_resort_online_reservation_system	1.0

References

https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-12.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.259462Permissions Required, VDB Entry
https://vuldb.com/?id.259462Third Party Advisory, VDB Entry
https://vuldb.com/?submit.310229Third Party Advisory, VDB Entry
https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-12.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.259462Permissions Required, VDB Entry
https://vuldb.com/?id.259462Third Party Advisory, VDB Entry
https://vuldb.com/?submit.310229Third Party Advisory, VDB Entry

Timeline

Published: Apr 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-335807.8A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges.CVE-2024-335817.8A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with CVE-2024-335827.8A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileg CVE-2024-335833.3A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manage CVE-2024-335844.7URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Vide CVE-2024-335854.3Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment G CVE-2024-335865.3Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through CVE-2024-335875.3Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Se CVE-2024-335885.4Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base d CVE-2024-335896.5Missing Authorization vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.6.0.CVE-2024-33599.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Library System 1.0. This issue affects some unkno CVE-2024-335905.0Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Kno