CVE-2024-28386

CriticalCVSS 9.8

Published: 25/03/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.45%

70th percentile - higher than 70% of all known CVEs

Summary

The fastmagsync plugin for Home-Made.io version 1.7.51 and earlier contains a vulnerability that allows a remote attacker to execute arbitrary code via the getPhpBin() component.

Risk Assessment

An attacker can remotely take over the server, leading to full system compromise, data theft, or malware installation.

Recommendation

Immediately update the fastmagsync plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.