CVE-2024-8464

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Job Portal	1.0
phpgurukul	job_portal	1.0

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portalThird Party Advisory

Timeline

Published: Sep 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-84657.5SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/c CVE-2024-84667.5SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/categ CVE-2024-84677.5SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/in CVE-2024-84687.5SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, an CVE-2024-84697.5SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/in CVE-2024-84707.5SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacan CVE-2024-84716.1Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability co CVE-2024-84726.1Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability co CVE-2024-84736.1Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability co CVE-2024-84747.5OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, CVE-2024-84756.5Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled V CVE-2024-84764.3The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is