CVE-2024-38293: Alcasar

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.

Affected products

• Alcasar Alcasar: before 3.6.1 (fixed in 3.6.1)

Published 2024-06-13. Last modified 2026-06-17.