CVE-2024-45264

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-452659.8A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c CVE-2024-452694.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection CVE-2024-45276.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is a CVE-2024-452704.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat CVE-2024-452717.8An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.CVE-2024-452727.5An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of su CVE-2024-452737.8An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of th CVE-2024-452749.8An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.CVE-2024-452759.8The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of CVE-2024-452767.5An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.CVE-2024-452774.3The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker CVE-2024-452785.4SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After su