CVE-2024-58306

HighCVSS 8.7/10Last modified Oct 27, 2026

Description

minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can send crafted HTTP requests with excessive data to overwhelm the server and cause service interruption.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
minalic	minaliC	2.0.0

References

Timeline

Published: Dec 11, 2025
Last modified: Oct 27, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-583078.8CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to CVE-2024-583089.8Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating th CVE-2024-583099.8xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by inject CVE-2024-58318.8Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-583108.7APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files CVE-2024-583119.8Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit CVE-2024-583127.5xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulatin CVE-2024-583137.2xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload a CVE-2024-583148.8Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script CVE-2024-583157.8Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code CVE-2024-583167.5Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject CVE-2024-583175.3A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration c