CVE-2024-48292

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
quickheal_antivirus_pro	quickheal_antivirus_pro	24.0
quickheal_total_security	quickheal_total_security	24.0

References

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-482936.5Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbit CVE-2024-482945.5A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Servi CVE-2024-483079.8JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.CVE-2024-483107.5AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys t CVE-2024-483118.8Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.CVE-2024-483125.4WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.CVE-2024-483228.1UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.CVE-2024-483258.1Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. Th CVE-2024-483368.4The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh CVE-2024-483413.7dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop CVE-2024-483436.3A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSea CVE-2024-483466.1xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered t