CVE-2024-50634

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
sbondco	watcharr	<= 1.43.0

References

Timeline

Published: Nov 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-506369.8PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM CVE-2024-506375.4UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an CVE-2024-50649.8A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been rated as critical. This issue affects some unknow CVE-2024-506409.8jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function CVE-2024-506418.1An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API CVE-2024-506449.8zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without CVE-2024-506459.8MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any toke CVE-2024-506477.5The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers ca CVE-2024-506489.8yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to p CVE-2024-506499.8The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.CVE-2024-50659.8A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function o CVE-2024-506507.5python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different I