CVE-2024-9418

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256

Affected software

Vendor	Product	Versions
transformeroptimus	transformeroptimus/superagi	>= unspecified, <= latest

References

https://huntr.com/bounties/9a8118a2-ea32-41f5-b501-fef4f31d8213Exploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-94199.8Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevati CVE-2024-94208.8A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a r CVE-2024-94215.4The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to CVE-2024-94226.6The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploa CVE-2024-94235.3Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. The printer di CVE-2024-94255.4The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_im CVE-2024-94266.4The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ CVE-2024-94275.4A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected i CVE-2024-94284.8The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2024-94299.8A vulnerability has been found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this vulnerability CVE-2024-94305.3The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due CVE-2024-94318.8In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, u