CVE-2024-1577: critical vulnerability in Jan Syski MegaBIP
Remote Code Execution in MegaBIP
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 1.1%
Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I/V:D/RE:M/U:Amber
Affected products
Jan Syski · MegaBIPRelated CVEs — Jan Syski MegaBIP
In the same product, most dangerous first.
CVE-2024-1659CRITICALArbitrary File Upload in MegaBIPEPSS 0.7%CVE-2024-6527CRITICALSQL Injection in MegaBIPEPSS 0.6%CVE-2024-1576CRITICALSQL Injection in MegaBIPEPSS 0.6%CVE-2023-5378HIGHStored XSS in SmodBIP and MegaBIPEPSS 0.5%CVE-2024-6880MEDIUMCSRF in MegaBIPEPSS 0.5%CVE-2025-3895CRITICALLow token entropy in MegaBIPEPSS 0.5%