Is CVE-2024-48928 actively exploited?

No active exploitation of CVE-2024-48928 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-48928 be exploited remotely?

Yes. CVE-2024-48928 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-48928?

CVE-2024-48928 has a CVSS score of 7.5 (HIGH) and an EPSS exploitation probability of 0.03%.

HOME VULNERABILITIESCVE-2024-48928

HIGH

CVE-2024-48928

CWE-330Published: February 24, 2026· Updated: Feb 25, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.2th

Official Description

Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto login key uses the user's password on top of the secret key. The pwg token uses the user's session identifier on top of the secret key. It seems that values for get_ephemeral_key can be generated when one knows the secret key. Version 15.0.0 contains a fix for the issue.

NVD Source

Technical Analysis

CVE-2024-48928 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.