GCVE - cpe:2.3:a:tongda2000:office_anywhere_2017:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tongda2000:office_anywhere_2017:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Tongda2000 (`402366c0-edf5-5533-ba75-dfdacc492d6c`)
Product	Office Anywhere 2017 (`d361a814-3682-57b8-a95e-655819ac1219`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-25320`	vulnerable	2026-06-08 06:31:22.788108	Details available Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php. Published: 2024-02-16T00:00:00.000Z Updated: 2024-08-20T18:55:59.808Z Open on db.gcve.eu Reference links https://github.com/cqliuke/cve/blob/main/sql.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1251`	vulnerable	2026-06-08 06:25:39.671074	Tongda OA 2017 delete.php sql injection MEDIUM (5.5) A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-252990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-02-06T16:00:06.750Z Updated: 2024-08-19T20:13:25.946Z Open on db.gcve.eu Reference links https://vuldb.com/?id.252990 https://vuldb.com/?ctiid.252990 https://github.com/rockersiyuan/CVE/blob/main/TongDa%20Sql%20inject.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-0938`	vulnerable	2026-06-08 06:22:03.176669	Tongda OA 2017 delete_webmail.php sql injection MEDIUM (5.5) A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/delete_webmail.php. The manipulation of the argument WEBBODY_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-252183. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-01-26T18:00:06.489Z Updated: 2025-06-17T14:44:39.779Z Open on db.gcve.eu Reference links https://vuldb.com/?id.252183 https://vuldb.com/?ctiid.252183 https://github.com/Yu1e/vuls/blob/main/SQL%20injection%20vulnerability%20exists%20in%20Tongda%20OA.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7180`	vulnerable	2026-06-08 06:21:57.197802	Tongda OA 2017 delete.php sql injection MEDIUM (5.5) A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2023-12-30T17:31:03.922Z Updated: 2024-09-09T20:44:23.232Z Open on db.gcve.eu Reference links https://vuldb.com/?id.249367 https://vuldb.com/?ctiid.249367 https://github.com/Bobjones7/cve/blob/main/sql.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7023`	vulnerable	2026-06-08 06:21:56.629860	Tongda OA 2017 delete.php sql injection MEDIUM (6.3) A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. Affected by this issue is some unknown functionality of the file general/vehicle/query/delete.php. The manipulation of the argument VU_ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-248570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2023-12-21T02:00:04.785Z Updated: 2024-09-13T14:59:50.932Z Open on db.gcve.eu Reference links https://vuldb.com/?id.248570 https://vuldb.com/?ctiid.248570 https://github.com/xiatiandeyu123/cve/blob/main/sql.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7022`	vulnerable	2026-06-08 06:21:56.629211	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7021`	vulnerable	2026-06-08 06:21:56.626315	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7020`	vulnerable	2026-06-08 06:21:56.624396	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.