CVE-2024-46048

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Sep 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-460499.8Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function.CVE-2024-46058.8The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. TCVE-2024-460549.8OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upCVE-2024-460554.8OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names.CVE-2024-46065.4Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit ElemenCVE-2024-460607.8Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directCVE-2024-460627.8Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home direcCVE-2024-46077.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture KCVE-2024-460736.1A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanCVE-2024-460769.8RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection ofCVE-2024-460775.4itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-usCVE-2024-460787.5itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduli
CVE-2024-46048: Critical severity, CVSS 9.8 | Vulnix