CVE-2024-13971

7.7 highEPSS 0.5%

High (7.7) in lobster-world lobster pro. EPSS 0.5% chance of exploitation in the next 30 days.

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Severity

CVSS 4.0

7.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/V:C

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2026-04-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lobster-world:lobster_pro

References

https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/
http://seclists.org/fulldisclosure/2026/May/1

Check your stack JSON