CVE-2024-32736: high-severity vulnerability in CyberPower PowerPanel Enterprise
CyberPower PowerPanel Enterprise SQL Injection
Published · Updated
58Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 5.4%
from disclosure to weapon
Published on NVDMay 9
VulnCheck+258d
exploitation probability
5.4%top 7% of all CVEs
observed exploitation
yesVulnCheck
A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_utask_verbose" function within MCUDBHelper.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
CyberPower · CyberPower PowerPanel EnterpriseRelated CVEs — CyberPower PowerPanel Enterprise
In the same product, most dangerous first.
CVE-2024-32735CRITICALCyberPower PowerPanel Enterprise Missing AuthenticationEPSS 6.8%CVE-2024-32739HIGHCyberPower PowerPanel Enterprise SQL InjectionEPSS 5.4%CVE-2024-32737HIGHCyberPower PowerPanel Enterprise SQL InjectionEPSS 5.4%CVE-2024-32738HIGHCyberPower PowerPanel Enterprise SQL InjectionEPSS 4.6%