CVE-2024-8762

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Crud Operation System 1.0. It has been classified as critical. This affects an unknown part of the file /updatedata.php. The manipulation of the argument sid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
code-projects	Crud Operation System	1.0
code-projects	crud_operation_system	1.0

References

https://code-projects.org/Product
https://github.com/Kangsiyuan/1/issues/1Exploit, Third Party Advisory
https://vuldb.com/?ctiid.277341Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.277341Third Party Advisory, VDB Entry
https://vuldb.com/?submit.406159Third Party Advisory, VDB Entry

Timeline

Published: Sep 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-87637.5A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specifically in the compileTextTempl CVE-2024-87647.5A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server si CVE-2024-87657.3In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as CVE-2024-87666.7Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2024-87679.9Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plu CVE-2024-87687.5A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial o CVE-2024-87699.1A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through rela CVE-2024-87706.1A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attac CVE-2024-87714.3The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-87724.351l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition CVE-2024-87738.3SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vul CVE-2024-87747.7The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges t