CVE-2024-48234

4.9 mediumEPSS 0.5%

Medium (4.9). EPSS 0.5% chance of exploitation in the next 30 days.

An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in Server-side request forgery (SSRF) vulnerability that can read server files.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2024-10-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/sansanyun/mipjz/issues/18

Check your stack JSON