What’s Vulnerable › Vulnerabilities

CVE-2024-3704: SQL Injection vulnerability in OpenGnsys

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-12 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.

Affected products

• OpenGnsys: 1.1.1d

References

• https://opengnsys.es/web/parche-de-seguridad-cve-2024-370x
• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsys
• https://opengnsys.es/web/parche-de-seguridad-cve-2024-370x
• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsys

Get alerted when CVE-2024-3704 or the next vulnerability affects your stack