CVE-2024-4202

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
Progress Software CorporationTelerik Reporting>= 1.0.0.0, < 18.1.24.2.514
progresstelerik_reporting>= 1.0.0.0, < 18.1.24.2.514

References

Timeline

Published
May 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-420205.4A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.CVE-2024-420216.5An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.CVE-2024-420225.3An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.CVE-2024-420238.8An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely.CVE-2024-420248.8A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution onCVE-2024-420257.8A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and eaCVE-2024-420276.7The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they havCVE-2024-420288.8A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaCVE-2024-420296.3xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single CVE-2024-42035.4The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions uCVE-2024-420306.2Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may CVE-2024-420317.5Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect servic
CVE-2024-4202: High severity, CVSS 8.6 | Vulnix