CVE-2024-2648

A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257286 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-643
• CWE-91

• https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-naccheck.mdExploit
• https://vuldb.com/?ctiid.257286Permissions Required, VDB Entry
• https://vuldb.com/?id.257286Third Party Advisory, VDB Entry
• https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-naccheck.mdExploit
• https://vuldb.com/?ctiid.257286Permissions Required, VDB Entry
• https://vuldb.com/?id.257286Third Party Advisory, VDB Entry

Published

Mar 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26473A reflected cross-site scripting (XSS) vulnerability in Soci…6.1
• CVE-2024-26475An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fi…5.5
• CVE-2024-26476An issue in open-emr before v.7.0.2 allows a remote attacker…3.5
• CVE-2024-26477An issue in Statping-ng v.0.91.0 allows an attacker to obtai…7.5
• CVE-2024-26478An issue in Statping-ng v.0.91.0 allows an attacker to obtai…5.3
• CVE-2024-26479An issue in Statping-ng v.0.91.0 allows an attacker to obtai…5.3
• CVE-2024-26480An issue in Statping-ng v.0.91.0 allows an attacker to obtai…7.5
• CVE-2024-26481Kirby CMS v4.1.0 was discovered to contain a reflected self-…4.7
• CVE-2024-26482An HTML injection vulnerability exists in the Edit Content L…7.1
• CVE-2024-26483An arbitrary file upload vulnerability in the Profile Image …8.8
• CVE-2024-26484A stored cross-site scripting (XSS) vulnerability in the Edi…6.1
• CVE-2024-26489A cross-site scripting (XSS) vulnerability in the Addon JD F…6.1