CVE-2024-24548

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Feb 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-245497.5Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if CVE-2024-24555.4The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2024-245508.1A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through CVE-2024-245518.8A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. Th CVE-2024-245528.8A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or an CVE-2024-245537.5Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force att CVE-2024-245548.2Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the use CVE-2024-245566.1urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit th CVE-2024-245577.8Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poi CVE-2024-245586.1TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-nex CVE-2024-245595.3Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Co CVE-2024-24566.4The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ver