Canto CVE-2024-25096

CRITICAL

Code Injection (CWE-94)

2024-04-03 audit@patchstack.com

RCE Code Injection Canto

10.0

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Apr 03, 2024 - 13:16 cve.org

CRITICAL 10.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.

AnalysisAI

Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.0.7. Affected products include: Canto. Version information: through 3.0.7..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

More in Canto

View all

CVE-2023-3452 CRITICAL Act Now POC

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'w

CVE-2022-40305 CRITICAL Act Now POC

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network,

CVE-2024-4936 CRITICAL Act Now

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via th

CVE-2013-7416 HIGH This Week POC

canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell

CVE-2026-3335 MEDIUM This Month POC

The Canto plugin for WordPress (versions up to 3.1.1) contains a critical missing authorization vulnerability in the cop

CVE-2020-28976 MEDIUM This Month POC

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. Rated medium severity (CVSS 5.3), this vulnera

CVE-2020-24063 HIGH This Week

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF. Rated high severity (CVSS 7.2), t

CVE-2020-28978 MEDIUM This Month POC

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. Rated medium severity (CVSS 5.3), this vulnerabi

CVE-2020-28977 MEDIUM This Month POC

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. Rated medium severity (CVSS 5.3), this vulnerabi

CVE-2026-6441 MEDIUM This Month

Authenticated attackers with subscriber-level WordPress access can bypass capability checks in the Canto plugin (version

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

CVE-2021-22205 CRITICAL POC

CVE-2012-0158 HIGH POC

CVE-2021-44529 CRITICAL POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2024-25096 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy