PatchTheCVEautoexpress vulnerabilities and fixes
Recent CVEs affecting autoexpress, with upgrade or downgrade steps. 4 tracked.
autoexpress has 4 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-04-19. Highest priority: CVE-2023-48902 (score 62/100).
- CVE-2024-30974 HIGH 7.3 DOWNGRADE SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carI
- CVE-2023-48903 MEDIUM 6.1 DOWNGRADE Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated
- CVE-2023-48902 CRITICAL 9.8 DOWNGRADE An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to esc
- CVE-2023-48901 CRITICAL 9.8 DOWNGRADE A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers
FAQ
How do I fix autoexpress vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is autoexpress being exploited right now?
None of the tracked autoexpress CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which autoexpress CVE should I patch first?
CVE-2023-48902 currently ranks highest (62/100): An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to esc.