CVE-2024-1202

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.

This issue affects Octopod: before v1. 

NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-120206.1There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could dCVE-2024-120218.5Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of CVE-2024-120236.5The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insCVE-2024-120246.1The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_cCVE-2024-120257.5The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categoCVE-2024-120264.3The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chCVE-2024-120274.3The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chCVE-2024-120285.3The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in allCVE-2024-120299.8A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnCVE-2024-12038.8The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQCVE-2024-120306.5The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shCVE-2024-120316.5The Advanced Floating Content plugin for WordPress is vulnerable to SQL Injection via the 'floating_content_duplicate_post' function in all
CVE-2024-1202: Critical severity, CVSS 9.8 | Vulnix