CVE-2024-1644

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Suite CRM version 7.14.2 allows including local php files. This is possible

because the application is vulnerable to LFI.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-16454.3The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistratiCVE-2024-16468.2parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checksCVE-2024-16477.5Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doeCVE-2024-16487.5electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application CVE-2024-16494.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16504.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16519.8Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to inseCVE-2024-16524.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16534.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16547.2This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have aCVE-2024-16558.8Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary sCVE-2024-16562.6Affected versions of Octopus Server had a weak content security policy.
CVE-2024-1644: High severity, CVSS 8.8 | Vulnix