CVE-2024-6118

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-256CWE-522

Affected software

VendorProductVersions
Hamastar TechnologyMeetingHub Paperless Meetings2021
hamastarmeetinghub_paperless_meetings2021

References

Timeline

Published
Aug 5, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-61197.5Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalCVE-2024-61206.5The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capabilityCVE-2024-61217.8An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. ThiCVE-2024-61225.5An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in informationCVE-2024-61237.2The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function iCVE-2024-61245.4Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victiCVE-2024-61258.1The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. ThisCVE-2024-61263.2A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenvCVE-2024-61279.8BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated atCVE-2024-61285.3A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of tCVE-2024-61293.7A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login oCVE-2024-61304.8The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege
CVE-2024-6118: Critical severity, CVSS 9.1 | Vulnix