ACEweb Online Portal vulnerabilities
5 known CVE vulnerabilities in ACEweb Online Portal, translated and rated.
- CVE-2022-24240Critical
ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2022-24239Critical
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
- CVE-2022-24581High
A vulnerability in ACEweb Online Portal 3.5.065 allows an unauthenticated attacker to capture SMB hashes by specifying an external UNC path when uploading a file. The attacker can trick the victim server into disclosing the username and password hash of the user running the ACEweb Online software.
- CVE-2022-24241High
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
- CVE-2022-24238Medium
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.