First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2024-2904

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-290404.3This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned b CVE-2024-290416.1Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are CVE-2024-290425.3Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attac CVE-2024-290438.8Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-290448.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-290457.5Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-290468.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-290478.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-290488.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-290494.7Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability CVE-2024-29056.2A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readab CVE-2024-290507.8Windows Cryptographic Services Remote Code Execution Vulnerability

CVE-2024-2904: High severity, CVSS 8.8 | Vulnix