Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-3704

SQL Injection vulnerability in OpenGnsys

Critical9.8EPSS 0.73%
Published
Updated
Reserved
Assigned by
INCIBE

Description

SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.

Scores

CVSS scores of CVE-2024-3704, by who scored it
Scored byCVSSScoreVector
INCIBECNA (assigner)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.73% · top 46% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

What to do

Solution: The OpenGnsys development team has released a security patch that resolves the reported vulnerabilities. These fixes will be included in the next version to be released shortly.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-3704 badge
[![CVE-2024-3704](https://trackcve.app/badge/CVE-2024-3704.svg)](https://trackcve.app/cve/CVE-2024-3704)

Record last updated .