CVE-2024-6695

CRITICAL EXPLOITED

Cozmoslabs Profile Builder <= 3.11.9 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-6695 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b/

Scores

CVSS v3 9.8
EPSS 0.0080
EPSS Percentile 51.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2024-07-23
CWE
CWE-863
Status published
Products (1)
cozmoslabs/profile_builder < 3.11.9
Published Jul 31, 2024
Tracked Since Feb 18, 2026