CVE-2024-6527

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages.  This issue affects MegaBIP software versions through 5.13.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:D/RE:M/U:Amber

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-65286.1CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulneraCVE-2024-65297.1The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page,CVE-2024-65305.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior CVE-2024-65326.4The Sheet to Table Live Sync for Google Sheet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STWT_Sheet_CVE-2024-65335.4Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the applCVE-2024-65344.3Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This CVE-2024-65355.3A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the CVE-2024-65365.4The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilegCVE-2024-65385.3A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL tCVE-2024-65394.8A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the fCVE-2024-65405.3Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorizCVE-2024-65416.8The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This a