CVE-2024-41617

9.8 criticalEPSS 1.1%

Critical (9.8). EPSS 1.1% chance of exploitation in the next 30 days.

Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security.php` fails to terminate script execution after redirecting unauthenticated users. This flaw allows an unauthenticated attacker to upload arbitrary files, potentially leading to Remote Code Execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2024-10-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d
https://github.com/moneymanagerex/web-money-manager-ex/issues/51
https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3
https://youtu.be/JaOrlT9G3yo?t=88

Check your stack JSON