CVE-2024-27292

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-706

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-272947.8dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the CVE-2024-272958.2Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows CVE-2024-272965.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number CVE-2024-272975.9Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix CVE-2024-2729810.0parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the Pos CVE-2024-272998.8phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has bee CVE-2024-27305.3Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public prev CVE-2024-273005.4phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user CVE-2024-273017.3Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstal CVE-2024-273029.1go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of dom CVE-2024-273037.3electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vul CVE-2024-273049.8pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 G