CVE-2024-6039

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268752.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	Feng Office	3.11.1.2

References

https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.htmlExploit
https://seclists.org/fulldisclosure/2024/Jun/2Mailing List, Third Party Advisory
https://vuldb.com/?ctiid.268752Permissions Required
https://vuldb.com/?id.268752Third Party Advisory
https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.htmlExploit
https://seclists.org/fulldisclosure/2024/Jun/2Mailing List, Third Party Advisory
https://vuldb.com/?ctiid.268752Permissions Required
https://vuldb.com/?id.268752Third Party Advisory

Timeline

Published: Jun 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-60408.8In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnera CVE-2024-60418.8A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an CVE-2024-60429.8A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some u CVE-2024-60439.8A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function l CVE-2024-60446.5Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can CVE-2024-60458.8Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area netwo CVE-2024-60479.8Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploi CVE-2024-60489.8Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker c CVE-2024-60497.5The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a speci CVE-2024-60506.1Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scrip CVE-2024-60514.3Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate th CVE-2024-60525.4Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HT