{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.0.9"}],"component":"billz/raspap-webgui","cve_ids":["CVE-2024-2497"],"ecosystem":"Packagist","epss":0.00907,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-99wg-vmvq-2cp5","id":"tcs_01M5KEZXGQZSMRBDP1HMTT2WTT","modified_at":"2025-04-10T13:27:12.516535Z","published_at":"2024-03-15T18:30:38Z","references":["https://osv.dev/vulnerability/GHSA-99wg-vmvq-2cp5","https://nvd.nist.gov/vuln/detail/CVE-2024-2497","https://github.com/RaspAP/raspap-webgui","https://toradah.notion.site/Code-Injection-Leading-to-Remote-Code-Execution-RCE-in-RaspAP-Web-GUI-d321e1a416694520bec7099253c65060?pvs=4","https://vuldb.com/?ctiid.256919","https://vuldb.com/?id.256919"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-99wg-vmvq-2cp5","url":"https://osv.dev/vulnerability/GHSA-99wg-vmvq-2cp5"}],"summary":"RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php`"}