CVE-2024-50647

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through https://ip:port/api/myapp/index/user/info?id=1 And modify the ID value to obtain sensitive user information beyond authorization.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-506489.8yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to p CVE-2024-506499.8The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.CVE-2024-50659.8A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function o CVE-2024-506507.5python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different I CVE-2024-506516.5java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs CVE-2024-506524.3A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.CVE-2024-506537.5CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once CVE-2024-506547.5lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturi CVE-2024-506555.4emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published artic CVE-2024-506566.1itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.CVE-2024-506576.8An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, spec CVE-2024-506589.8Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBill