CVE-2024-32231
MEDIUM NUCLEIStash < 0.25.1 - SQL Injection via Sort Parameter
Title source: llmExploitation Summary
CVE-2024-32231 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.
Nuclei Templates (1)
Stash < 0.26.0 - SQL Injection
CRITICALVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan:
html:"<title>Stash</title>"
References (3)
Core 3
Core References
Product
https://github.com/stashapp
Scores
CVSS v3
6.3
EPSS
0.0118
EPSS Percentile
63.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (2)
stashapp/stash
< 0.25.1
stashapp/stash
0 - 0.26.0Go
Published
Aug 15, 2024
Tracked Since
Feb 18, 2026