CVE-2024-48246

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 5, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-482488.6NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lCVE-2024-482497.3Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-48259.8A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via pCVE-2024-482519.8Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-482539.8Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.CVE-2024-482559.8Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.CVE-2024-482579.8Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.CVE-2024-482597.3Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.CVE-2024-48269.8SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all thCVE-2024-482707.5An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.CVE-2024-482718.8D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers tCVE-2024-482726.5D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the dev