CVE-2024-8023

A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-89

• https://gist.github.com/topsky979/74dcbe81062718f314d81fb6ad5dc1e0Exploit
• https://vuldb.com/?ctiid.275292Permissions Required, VDB Entry
• https://vuldb.com/?id.275292Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.390087Third Party Advisory, VDB Entry

Published

Aug 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8017An XSS vulnerability exists in open-webui/open-webui version…9
• CVE-2024-8018A vulnerability in imartinez/privategpt version 0.5.0 allows…7.5
• CVE-2024-8019In lightning-ai/pytorch-lightning version 2.3.2, a vulnerabi…9.1
• CVE-2024-8020A vulnerability in lightning-ai/pytorch-lightning version 2.…7.5
• CVE-2024-8021An open redirect vulnerability exists in the latest version …6.1
• CVE-2024-8022A vulnerability was found in Genexis Tilgin Home Gateway 322…5.3
• CVE-2024-8024A CORS misconfiguration vulnerability exists in netease-youd…7.5
• CVE-2024-8025Nikon NEF Codec Thumbnail Provider NRW File Parsing Heap-bas…7.8
• CVE-2024-8026A Cross-Site Request Forgery (CSRF) vulnerability exists in …8.1
• CVE-2024-8027A stored Cross-Site Scripting (XSS) vulnerability exists in …6.1
• CVE-2024-8028A vulnerability in danswer-ai/danswer v0.3.94 allows an atta…7.5
• CVE-2024-8029An XSS vulnerability was discovered in the upload file(s) pr…6.1