CVE-2024-9150CWE-1336

Code Injection in Wyn Enterprise

High · published February 21, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a host system with applications high privileges.

This issue has been fixed in version 8.0.00204.0

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2025-02-21T11:40Z
EPSS history
Timeline
  • 21 FEB 11:40Z
    Code Injection in Wyn Enterprise
    cvelistv5