CVE Record: CVE-2024-9150

alert

Notice: Keyword searching of CVE Records is now available in the search box above. Keywords may include a CVE ID (e.g., CVE-2024-1234), or one or more keywords separated by a space (e.g., authorization, SQL Injection, cross site scripting, etc.). Learn more here.

alert

Notice: Keyword searching of CVE Records is now available in the search box above. Keywords may include a CVE ID (e.g., CVE-2024-1234), or one or more keywords separated by a space (e.g., authorization, SQL Injection, cross site scripting, etc.). Learn more here.

Expand or collapse notification button

Required CVE Record Information

Description

Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a host system with applications high privileges. This issue has been fixed in version 8.0.00204.0

CWE 1 Total

CWE-1336: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

CVSS 1 Total

Product Status

Versions 1 Total

Default Status: unaffected

affected

Credits

Maksym Brzęczek (efigo.pl) finder

References 3 Total

https://www.wynenterprise.com/
external site
product
https://cert.pl/en/posts/2025/02/CVE-2024-9150
external site
third-party-advisory
https://efigo.pl/blog/cve-2024-9150/
external site
technical-description

Authorized Data Publishers