CVE-2024-2412

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1220

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-241223.3A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp CVE-2024-24139.8Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the use CVE-2024-241306.1Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter CVE-2024-241316.1SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.CVE-2024-241339.8Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.CVE-2024-241344.8Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update M CVE-2024-241356.1Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XS CVE-2024-241366.1The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (X CVE-2024-241397.2Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.CVE-2024-24148.8The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open CVE-2024-241407.2Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'CVE-2024-241419.8Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.