What’s Vulnerable › Vulnerabilities

CVE-2024-58309: xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-11 · updated 2026-10-27
• Weakness: CWE-89

Description

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

Affected products

• xbtitFM: 4.1.18

References

• https://www.exploit-db.com/exploits/51909
• https://www.vulncheck.com/advisories/xbtitfm-unauthenticated-sql-injection-in-shouteditphp
• https://xbtitfm.eu

Get alerted when CVE-2024-58309 or the next vulnerability affects your stack