CVE-2024-32640criticalobserved exploitationCWE-89

CVE-2024-32640: critical vulnerability in MasaCMS

MasaCMS SQL Injection vulnerability

Published · Updated

Follow this CVE+ Monitor MasaCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 78%
from disclosure to weaponsame day
Published on NVDAug 11
1st PoCMay 16
VulnCheckMay 16
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
MasaCMS · MasaCMS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MasaCMS

In the same product, most dangerous first.

CVE-2024-32641CRITICALMasa CMS Vulnerable to Pre-Auth RCE via JSON APIEPSS 13.1%CVE-2026-40330CRITICALMasa CMS SQL injection via sortDirection parameter in beanFeedEPSS 0.4%CVE-2024-32643HIGHMasa CMS vulnerable to authentication bypass with /tag/EPSS 0.4%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2026-40331CRITICALMasa CMS unauthenticated SQL injection via altTable parameter in JSON APIEPSS 0.3%CVE-2026-40329CRITICALSQL Injection vulnerability via sortBy in beanFeedEPSS 0.3%