CVE-2024-5985

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268461 was assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 14, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-59869.1A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved CVE-2024-59874.3The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2024-59889.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable andCVE-2024-59899.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program aCVE-2024-59907.5Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell AutomaCVE-2024-59917.5In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. SpecificallCVE-2024-59926.5The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaCVE-2024-59935.4The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaCVE-2024-59945.4The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions CVE-2024-59958.8The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly cCVE-2024-59974.3The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to aCVE-2024-59987.8A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data.