alcasar vulnerabilities and fixes

Recent CVEs affecting alcasar, with upgrade or downgrade steps. 3 tracked.

alcasar has 3 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 3. Most recent: 2024-06-13. Highest priority: CVE-2024-38295 (score 53/100).

• CVE-2024-38295 CRITICAL 9.8 UPGRADE ALCASAR before 3.6.1 allows still_connected.php remote code execution.
• CVE-2024-38294 CRITICAL 9.8 UPGRADE ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
• CVE-2024-38293 CRITICAL 9.6 UPGRADE ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.

FAQ

How do I fix alcasar vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is alcasar being exploited right now?

None of the tracked alcasar CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which alcasar CVE should I patch first?

CVE-2024-38295 currently ranks highest (53/100): ALCASAR before 3.6.1 allows still_connected.php remote code execution..

RSS feed for alcasar · ← Back to latest CVEs