CVE-2024-1651

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Torrentpier version 2.4.1 allows executing arbitrary commands on the server.

This is possible because the application is vulnerable to insecure deserialization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-16524.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16534.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16547.2This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have aCVE-2024-16558.8Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary sCVE-2024-16562.6Affected versions of Octopus Server had a weak content security policy.CVE-2024-16578.1A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible ruleboCVE-2024-16585.4The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back CVE-2024-16599.8Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) withoutCVE-2024-16604.8The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-16615.5A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown fCVE-2024-16627.5Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBaCVE-2024-16634.8The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow hig
CVE-2024-1651: Critical severity, CVSS 9.8 | Vulnix