CVE-2024-42327
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function …
Read full description
Attention and evidence
Evidence confidence: PoC published; attacks unconfirmed
Hype components
Sources and documents
No source documents yet.
Score evolution
● Hype ● Reality
Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.
First record: hype 0.0 · reality 5.8 (2026-11-02 15:13). The curve appears once the score changes.
Public exploit evidence
Public exploit entries / repo candidates
Source entries and unverified repository candidates are counted separately.
Evidence context and dated references
Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.
Evidence in context
- Confidence in exploitation evidence
- PoC published; attacks unconfirmed
- Priority basis
- Exploitation in attacks unconfirmed; CVSS 9.9; EPSS 79.1%
- Attention, last 30 days
- 0 distinct story titles; 0 press documents; 0 publisher domains.
- Technical potential
- network access, low privileges, no user interaction.
- Observed activity
- Public PoC evidence is present.
- Known scale
- Not quantified.
- Evidence confidence basis
- Published PoC artifact; functionality unverified
Score evaluated: 2026-11-05 13:59:16.850043+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z