CVE-2024-24573

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-245746.1phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\p CVE-2024-245757.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2024-2457610.0Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not pr CVE-2024-245779.8libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2024-245789.8RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20 CVE-2024-245799.8stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to c CVE-2024-24585.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes CVE-2024-245805.5Improper conditions check in some Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow a privileged user to potentially enab CVE-2024-245817.8in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution through out-of-bounds write.CVE-2024-245827.5Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable e CVE-2024-245834.3Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to a CVE-2024-245844.3Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to a