CVE-2024-48310

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-483118.8Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.CVE-2024-483125.4WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.CVE-2024-483228.1UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.CVE-2024-483258.1Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. Th CVE-2024-483368.4The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh CVE-2024-483413.7dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop CVE-2024-483436.3A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSea CVE-2024-483466.1xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered t CVE-2024-48358.2A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this cond CVE-2024-483527.5Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enter CVE-2024-483537.5Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintex CVE-2024-483569.8LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.