CVE-2024-3704criticalCWE-89

CVE-2024-3704: critical vulnerability in OpenGnsys

SQL Injection vulnerability in OpenGnsys

Published · Updated

Follow this CVE+ Monitor OpenGnsys

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.7%
SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
OpenGnsys · OpenGnsys
Related CVEs — OpenGnsys

In the same product, most dangerous first.

CVE-2024-3705HIGHUnrestricted Upload of File with Dangerous Type vulnerability in OpenGnsysEPSS 0.8%CVE-2024-3706MEDIUMExposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenGnsysEPSS 0.5%CVE-2024-3707MEDIUMExposure of Information Through Directory Listing vulnerability in OpenGnsysEPSS 0.5%