CVE-2024-42844

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-428458.0An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to ex CVE-2024-428496.5An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.CVE-2024-428509.8An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.CVE-2024-428517.8Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function.CVE-2024-428526.1Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php CVE-2024-42864.9Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statemen CVE-2024-428617.5An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message CVE-2024-42877.2In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the ap CVE-2024-42885.4The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scrip CVE-2024-428859.1SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp CVE-2024-42896.1The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages a CVE-2024-428985.4A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted p