CVE-2024-58301: Purei CMS

Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.

Affected products

• Purei Purei CMS: version 1.0 only

Published 2025-12-11. Last modified 2026-06-17.