Vulnerabilities

TI-2024-25573 CVE-2024-38295 · GHSA-mj6c-grgr-xq75

ALCASAR before 3.6.1 allows still_connected.php remote code execution.

MEDIUM 44

ALCASAR before 3.6.1 allows still_connected.php remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00768 Published 2024-06-13 No fix listed

TI-2024-25572 CVE-2024-38294 · GHSA-rx3m-g787-cp2f

MEDIUM 44

ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00768 Published 2024-06-13 No fix listed

TI-2024-25571 CVE-2024-38293 · GHSA-463q-9cmj-p927

MEDIUM 43

ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00352 Published 2024-06-13 No fix listed CWE-352