CVE-2024-6680

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality of the file /api/dept/build. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271153 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
witmy	my-springsecurity-plus	2024-07-04
witmy	my-springsecurity-plus	< 2024.07.04

References

https://gitee.com/witmy/my-springsecurity-plus/issues/IAAH8AIssue Tracking
https://vuldb.com/?ctiid.271153Permissions Required, VDB Entry
https://vuldb.com/?id.271153Third Party Advisory, VDB Entry
https://gitee.com/witmy/my-springsecurity-plus/issues/IAAH8AIssue Tracking
https://vuldb.com/?ctiid.271153Permissions Required, VDB Entry
https://vuldb.com/?id.271153Third Party Advisory, VDB Entry

Timeline

Published: Jul 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-66819.8A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue i CVE-2024-66849.9Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.CVE-2024-66854.3An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 1 CVE-2024-66877.5The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3 CVE-2024-66884.3The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save CVE-2024-66897.8Local Privilege Escalation in MSI-Installer in baramundi Management Agent v23.1.172.0 on Windows allows a local unprivileged user to escalat CVE-2024-66906.1The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to extern CVE-2024-66914.0The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to CVE-2024-66923.1The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to CVE-2024-66934.8The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-66942.7The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plug CVE-2024-66959.8it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized