CVE-2022-24637

CVE-2022-24637 Exploit for the Unauthenticated RCE in Open Web Analytics OWA 1.7.3. This work is based on https://devel0pment.de/?p=2494. DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

CVE-2022-24637

CVE-2022-24637 RCE no autenticado en Open Web Analytics versión / newPassword YourIp YourPort Puede ser posible que necesite ejecutarlo varias veces para obtener una shell. El script puede ser mejorado...

CVE-2022-24638

VISTO EN EXPLOITDB: https://www.exploit-db.com/exploits/51026 ESTA VERSIÓN ESTÁ CORREGIDA PARA EVITAR FALSOS NEGATIVOS CVE-2022-24637 Exploit para el RCE no autenticado en Open Web Analytics OWA 1.7.4. Este trabajo se basa en https://devel0pment.de/?p=2494. DESCARGO DE RESPONSABILIDAD: Este scrip...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics OWA - Unauthenticated Remote Code Execution https://vulners.com/cve/CVE-2022-24637 Example python3 exploit.py -u admin -p hacker http://target.org 10.10.11.12 4444...

CVE-2022-24637

CVE-2022-24637 — Open Web Analytics antérieur à 1.7.4 Notes défensives sur une vulnérabilité critique de divulgation d'informations non authentifiée dans Open Web Analytics OWA pouvant mener à une élévation de privilèges. Rencontrée lors du travail sur la machine Fruityloops sur echoCTF, qui...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics 1.7.3 - Remote Code Execution Exploit v2 Working exploit for Open Web Analytics 1.7.3 - RCE enhenced with pentestmonkey's php reverse shell, Fixed issue of not able to find user in cache. Original soruce exploit can be found on here Usage Add your attacker...

CVE-2022-24637

Vulnerable Application Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with ' and get IPAddress, e.g 172.22.0.2 Database...

CVE-2026-97865

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865

A security flaw in Open-Web-Analytics (up to version 1.8.1) allows for remote deserialization . The vulnerability exists within the Event::loadFromArray function in the queue.php file of the Remote Event Queue Endpoint component. An attacker can initiate this attack remotely by performing manipul...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

EUVD-2026-87090

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

PT-2026-98852

Name of the Vulnerable Software and Affected Versions Open-Web-Analytics versions prior to 1.8.2 Description A flaw in the Remote Event Queue Endpoint component allows remote attackers to trigger deserialization by manipulating the Event::loadFromArray function within the queue.php file...

CVE-2026-97865: Deserialization of Untrusted Data

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

Open Web Analytics 1.7.3 - Remote Code Execution

Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 — Open Web Analytics prior to 1.7.4 Defensiv...

CVE-2026-86810

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810

Open-Web-Analytics (up to 1.9.1) contains an improper authentication vulnerability in the checkCapabilityAndAuthenticateUser function within Core/Controller.php (Controller component). A remote, unauthenticated attacker can manipulate this function to bypass authentication checks. The CVSS 3.1 sc...