CVE-2024-37873

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
payroll_management_system_project	payroll_management_system	1.0

References

https://github.com/TThuyyy/cve1/issues/2Exploit, Technical Description, Third Party Advisory
https://github.com/TThuyyy/cve1/issues/2Exploit, Technical Description, Third Party Advisory

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-378775.5UERANSIM before 3.2.6 allows out-of-bounds read when a RLS packet is sent to gNodeB with malformed PDU length. This occurs in function readO CVE-2024-378786.1Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime CVE-2024-378794.8Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr CVE-2024-37886.6Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers CVE-2024-378807.5The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a tim CVE-2024-378815.3SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirect CVE-2024-378828.1Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more CVE-2024-378834.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2024-378845.4Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they on CVE-2024-378857.8The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop CVE-2024-378864.7user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is CVE-2024-378873.5Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is