Lylme Spage CVE-2024-36675

CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2024-06-04 cve@mitre.org

SSRF Lylme Spage

9.1

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

1

CVE Published

Jun 04, 2024 - 22:15 nvd

CRITICAL 9.1

DescriptionNVD

LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.

AnalysisAI

LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function. Affected products include: Lylme Lylme Spage.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.

More in Lylme Spage

View all

CVE-2024-48356 CRITICAL Act Now POC

LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php. Rated critical severity (CVSS 9.8), this vulner

CVE-2024-48357 CRITICAL Act Now POC

LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php. Rated critical severity (CVSS 9.8),

CVE-2024-34982 CRITICAL Act Now POC

An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to exec

CVE-2023-45952 CRITICAL Act Now POC

An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute

CVE-2023-45951 CRITICAL Act Now POC

lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php. Ra

CVE-2025-4543 MEDIUM This Month POC

A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. Rated medium severity (CVSS 6.9), this

CVE-2024-36674 MEDIUM This Month POC

LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php. Rated medium severity (CVSS 6.1), thi

CVE-2024-48176 CRITICAL Act Now

Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2024-9790 MEDIUM This Month POC

A vulnerability was found in LyLme_spage 1.9.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploit

CVE-2024-9789 MEDIUM This Month POC

A vulnerability was found in LyLme_spage 1.9.5 and classified as critical.php. Rated medium severity (CVSS 5.1), this vu

CVE-2024-9788 MEDIUM This Month POC

A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical. Rated medium severity (CVSS 5.1), this v

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all

CVE-2021-34473 CRITICAL POC

CVE-2021-26855 CRITICAL POC

CVE-2022-41040 HIGH POC

CVE-2024-21893 HIGH POC

CVE-2023-48022 CRITICAL POC

CVE-2016-3718 MEDIUM POC

CVE-2015-8813 HIGH POC

CVE-2020-24881 CRITICAL POC

Same technique SSRF

View all

CVE-2016-3718 MEDIUM POC

CVE-2015-8813 HIGH POC

CVE-2020-24881 CRITICAL POC

CVE-2026-15409 CRITICAL POC

CVE-2024-54385 HIGH POC

CVE-2022-45835 MEDIUM POC

CVE-2024-54330 HIGH POC

CVE-2026-20230 HIGH POC

Share

CVE-2024-36675 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy