Ellevo

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Ellevo records in CISA KEV

No Ellevo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ellevo 3 records MEDIUM

Records

3 records in Ellevo · all components

TI-2024-28602 CVE-2024-42759 · GHSA-vw78-5596-vx6r

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the…

MEDIUM 63

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.

CVSS 3.1MEDIUM 6.3 Local High privileges No interaction EPSS 0.00359 Published 2024-09-09 No fix listed CWE-592

TI-2024-31085 CVE-2024-46655 · GHSA-3273-8cp5-whhv

A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload or URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00377 Published 2024-09-25 No fix listed CWE-79

TI-2024-28603 CVE-2024-42760 · GHSA-cvgf-c753-74qx

SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain…

MEDIUM 40

SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00571 Published 2024-09-11 No fix listed CWE-89

Open these records in search →

Critical	0
High	1
Medium	2
Low	0
No CVSS	0