CVE-2024-48200

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI is spawning one Administrative cmd (conhost.exe)

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-482029.8icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.CVE-2024-482049.8SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted CVE-2024-482069.8A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.CVE-2024-482088.6pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.CVE-2024-48215.4The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbo CVE-2024-482134.3RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.CVE-2024-482148.4KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. T CVE-2024-482178.8An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.CVE-2024-482187.2Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.CVE-2024-48226.1Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability CVE-2024-482227.2Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.CVE-2024-482237.2Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.