CVE-2024-24621

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-697

Affected software

No affected versions have been published.

Timeline

Published: Jul 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-246228.8Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulne CVE-2024-246238.8Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can expl CVE-2024-24638.0Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions th CVE-2024-24646.3This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not,CVE-2024-24657.1Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue aff CVE-2024-24666.5libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcu CVE-2024-24675.9A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a netwo CVE-2024-24685.4The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl CVE-2024-246807.5An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subjec CVE-2024-246819.8An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2).CVE-2024-246836.5Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to u CVE-2024-246847.8Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can