Alldata

alldata

7 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-29434 1Alldata 1Alldata Apr 30, 2025 Apr 2, 2024 N/A· v4 8.3 HIGH· v3 N/A· v2 An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.
CVE-2024-29432 1Alldata 1Alldata Apr 30, 2025 Apr 2, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
CVE-2024-27605 1Alldata 1Alldata Mar 28, 2025 Apr 2, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.
CVE-2024-27604 1Alldata 1Alldata Mar 27, 2025 Apr 2, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.
CVE-2024-27602 1Alldata 1Alldata Apr 30, 2025 Apr 2, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.
CVE-2024-29435 1Alldata 1Alldata May 7, 2025 Apr 1, 2024 N/A· v4 4.1 MEDIUM· v3 N/A· v2 An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.
CVE-2024-29433 1Alldata 1Alldata May 7, 2025 Apr 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.