CVE-2017-11681

8.8 highEPSS 1.2%

High (8.8) in project hashtopussy hashtopussy. EPSS 1.2% chance of exploitation in the next 30 days.

Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2017-07-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

project_hashtopussy:hashtopussy

References

https://github.com/s3inlc/hashtopussy/issues/241
https://github.com/s3inlc/hashtopussy/issues/241

Check your stack JSON