CVE-2024-2478

A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-89

• https://github.com/zuizui35/cve/blob/main/cve.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.256886Permissions Required
• https://vuldb.com/?id.256886Permissions Required
• https://github.com/zuizui35/cve/blob/main/cve.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.256886Permissions Required
• https://vuldb.com/?id.256886Permissions Required

Published

Mar 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24774Mattermost Jira Plugin handling subscriptions fails to check…4.1
• CVE-2024-24775When a virtual server is enabled with VLAN group and SNAT li…7.5
• CVE-2024-24776Mattermost fails to check the required permissions in the PO…4.3
• CVE-2024-24777A cross-site request forgery (CSRF) vulnerability exists in …8.8
• CVE-2024-24778Improper privilege management in a REST interface allowed re…6.5
• CVE-2024-24779Apache Superset with custom roles that include `can write on…6.5
• CVE-2024-24780Remote Code Execution with untrusted URI of UDF vulnerabilit…9.8
• CVE-2024-24781An unauthenticated remote attacker can use an uncontrolled r…7.5
• CVE-2024-24782An unauthenticated attacker can send a ping request from one…4.3
• CVE-2024-24783Verifying a certificate chain which contains a certificate w…5.9
• CVE-2024-24784The ParseAddressList function incorrectly handles comments (…7.5
• CVE-2024-24785If errors returned from MarshalJSON methods contain user con…5.4