CVE Database · CVE-2024-29824
CVSS v3.1
8.8
EPSS
99.95%
Published
May 31, 2024
Modified
Oct 30, 2025
CISA Known Exploited Vulnerability
Added: 2024-10-02 · Due: 2024-10-23
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public PoC / Exploit (4)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses (CWE)
Affected Products (7)
References (3)