PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2024-4040 exploited in the wild: everything you need to know

wiz.io | vulnerability | CVE-2024-4040 | #rce | #vulnerability | #patching | #exploited-in-the-wild | #crushftp | #cve-2024-4040
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz covers CVE-2024-4040, a critical CrushFTP sandbox escape scored 9.8 and exploited in the wild, escalating to unauthenticated RCE; patch guidance covers versions before 10.7.1 and 11.1.0.
CVE
CVE-2024-4040
Published
Collected

Related coverage

vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · wiz.io
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
vulnerability · wiz.io
Inside the Metabase SQLi: Exploited in the Wild
Wiz reverse-engineers CVE-2026-72898, the Metabase SQLi exploited in the wild via /api/session/reset_password since the Aug 6 incident; about 13% of cloud environments self-host Metabase.
vulnerability · wiz.io
Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild
CVE-2026-0300: a buffer overflow in PAN-OS User-ID Authentication Portal (CVSS 9.3) allows unauthenticated root RCE, with limited in-the-wild exploitation of exposed instances; patching advised.
Back