CVE-2024-8503
VICIdial Unauthenticated SQL Injection
CRITICAL 9.8EPSS 79.3%
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
- Affected
- VICIdial
- CVSS v3.1 CNA
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 79.27% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- critical · CWE-89
- Published
- 2024-09-10
- Updated
- 2025-11-04
Proof-of-concept exploits (2)
- Chocapikk/CVE-2024-850444★ · 2024-09-15
- Machine-farmer/vicidial-cve-2024-8503-blind-sqli-poc0★ · 2026-04-29