CVE-2024-5514

—

CVSS 3.1

9.8 critical

EPSS

<1%p49

Published

May 30, 2024 (May 30, 2024)

Modified

Jun 17, 2026

Description

MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

Weakness: CWE-798, CWE-912
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.