My CVEs 🛡️

My CVEs 🛡️


Total CVEs: 24 🛡️

Year Number of CVEs
2023 1
2024 21
2025 2

🗓️ CVEs from 2025


🗓️ CVEs from 2024

CVE-2024-22899 🛡️

🔗 Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

CVE-2024-22900 🛡️

🔗 Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

CVE-2024-22901 🛡️

🔗 Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

CVE-2024-22902 🛡️

🔗 Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

CVE-2024-22903 🛡️

🔗 Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

CVE-2024-25228 🛡️

🔗 Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

CVE-2024-30920 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component.

CVE-2024-30921 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component.

CVE-2024-30922 🛡️

🔗 SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.

CVE-2024-30923 🛡️

🔗 SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering.

CVE-2024-30924 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.

CVE-2024-30925 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component.

CVE-2024-30926 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component.

CVE-2024-30927 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component.

CVE-2024-30928 🛡️

🔗 SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc.

CVE-2024-30929 🛡️

🔗 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php.

CVE-2024-31818 🛡️

🔗 Directory Traversal vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component.

CVE-2024-31819 🛡️

🔗 An issue in WWBN AVideo v12.4 through v14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.

CVE-2024-3032 🛡️

🔗 Themify Builder < 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue.

CVE-2024-35373 🛡️

🔗 Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.

CVE-2024-35374 🛡️

🔗 Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, leading to remote code execution (RCE).


🗓️ CVEs from 2023