CVE-2024-27488

9.8 criticalEPSS 0.6%

Critical (9.8). EPSS 0.6% chance of exploitation in the next 30 days.

Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api interface, but the secret is hardcoded by default.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-259
Published: 2024-04-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/tr4pmaker/44442d6f068458175213f4ba71da1312
https://gist.github.com/tr4pmaker/44442d6f068458175213f4ba71da1312

Check your stack JSON