← Database

CVE-2024-8503

CRITICAL CVSS: 9.8 Published: 2024-09-10 Modified: 2026-06-17

Description

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

Affected Platforms

Unknown

Weakness Type

CWE-89

References