Read the docs
TI-2024-06579 Aliases CVE-2024-7104GHSA-w784-6hh8-995v

Remote Code Execution in SFS Consulting's ww.Winsure

Priority MEDIUM 42CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection. This issue affects ww.Winsure: before 4.6.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Fixed ww.Winsure (SFS Consulting): 4.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SFS Consultingww.Winsurebefore 4.6.24.6.2Patch availableCNA
  • ww.Winsure VendorSFS Consulting Affected before 4.6.2 Fixed in 4.6.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sfs:winsure:*:*:*:*:*:*:*:*before 4.6.2VulnerableSFS Consulting
  • cpe:2.3:a:sfs:winsure:*:*:*:*:*:*:*:* Versions before 4.6.2 Vulnerable ·SFS Consulting

Remediation

  • Fix · CNA ww.Winsure (SFS Consulting) Fixed in 4.6.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SFS Consulting ww.Winsure 4.6.2

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-06573 XML Injection in SFS Consulting's ww.WinsurePriority MEDIUM 42
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7104
  2. 2026-10-03 Alias added: GHSA-w784-6hh8-995v

References

Other 2

  • TI-2024-06573 XML Injection in SFS Consulting's ww.Winsure CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences