Facilemanager
Approved changes feed: RSS · Atom
cpe:2.3:a:willyxj:facilemanager:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Willyxj (1147397f-a90f-5a8a-9ee5-b24ee26e9064) |
|---|---|
| Product | Facilemanager (fb815243-186f-5b35-b479-61548df75dd4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-24573 |
vulnerable | 2026-06-08 06:29:41.504509 |
facileManager Privilege Escalation via Mass Assignment
HIGH (8.8)
facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.
Published: 2024-01-31T22:33:11.697Z
Updated: 2025-06-16T18:24:44.392Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24572 |
vulnerable | 2026-06-08 06:29:41.504088 |
facileManager Authenticated Variable Manipulation leading to SQL Injection
MEDIUM (6.5)
facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql
variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.
Published: 2024-01-31T22:33:08.498Z
Updated: 2024-10-17T17:08:31.130Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24571 |
vulnerable | 2026-06-08 06:29:41.496767 |
facileManager Systemic Cross-Site Scripting (XSS)
MEDIUM (5.4)
facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation.
Published: 2024-01-31T22:32:51.646Z
Updated: 2025-05-29T15:03:05.207Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.