Skip to main content

Panel CVE-2024-5960

CRITICAL
Plaintext Storage of a Password (CWE-256)
2024-09-18 iletisim@usom.gov.tr
Information Disclosure Panel
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 18, 2024 - 15:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials.

This issue affects Panel: before v2.3.24.

AnalysisAI

Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials.3.24. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-256. Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials.3.24. Affected products include: Elizsoftware Panel.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Panel

View all
CVE-2026-33746 CRITICAL
9.8 Apr 02

JWT signature verification bypass in ConvoyPanel 3.9.0-beta through 4.5.0 allows unauthenticated remote attackers to for
CVE-2024-6877 CRITICAL
9.4 Sep 18

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Softwa
CVE-2024-5958 CRITICAL
9.4 Sep 18

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Pane
CVE-2017-16807 MEDIUM POC
5.4 Nov 13

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
CVE-2024-5959 CRITICAL
9.3 Sep 18

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Softwa
CVE-2020-26255 CRITICAL
9.1 Dec 08

Kirby is a CMS. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. T
CVE-2026-34241 HIGH
8.7 May 19

Stored cross-site scripting in CtrlPanel (versions ≤1.1.1) allows a low-privileged ticket participant to inject arbitrar
CVE-2026-26016 HIGH
8.1 Feb 19

Missing authorization validation in Pterodactyl Wings prior to version 1.12.1 allows authenticated nodes to access and m
CVE-2021-41129 HIGH
8.1 Oct 06

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Rated high severity (CVSS 8.
CVE-2019-1020002 HIGH
7.5 Jul 29

Pterodactyl before 0.7.14 with 2FA allows credential sniffing. Rated high severity (CVSS 7.5), this vulnerability is rem
CVE-2025-69198 MEDIUM
6.5 Jan 19

Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to

CVE-2026-34233 MEDIUM
6.5 May 19

CtrlPanel versions 1.1.1 and prior expose administrative DataTable endpoints without enforcing admin-level authorization

Same weakness CWE-256 – Plaintext Storage of a Password

View all
CVE-2024-33375 CRITICAL POC
9.8
CVE-2018-25396 HIGH POC
8.7
CVE-2024-49370 HIGH POC
8.7
CVE-2024-40116 HIGH POC
8.1
CVE-2020-8183 HIGH POC
7.5
CVE-2019-10921 HIGH POC
7.5
CVE-2024-9418 MEDIUM POC
6.5
CVE-2020-37115 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-5960 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy