Cyber Resilience

CVE-2024-46636

Critical

Published: 27 April 2026

Published
27 April 2026
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0033 25.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2024-46636 is a critical-severity SQL Injection (CWE-89) vulnerability in Linkedin (inferred from references). Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-46636 is a SQL injection vulnerability (CWE-89) affecting NASA's Earth Observing System Data and Information System (EOSDIS) MODAPS version 8.1, specifically in the category parameter. The flaw allows attackers to inject malicious SQL code, earning a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating critical severity due to its high impact on confidentiality and integrity with low complexity and no prerequisites for exploitation.

Remote attackers require no authentication, privileges, or user interaction to exploit the vulnerability over the network. Successful exploitation enables high-level data extraction (confidentiality), manipulation or deletion of database contents (integrity), and limited denial-of-service effects (availability), potentially compromising sensitive NASA Earth observation data.

Advisories and further details are available via references including a Bugcrowd report at https://bugcrowd.com/Xnu11, a GitHub repository at https://github.com/NU1L0/CVE-2024-46636-SQLi-MODAPS documenting the issue, and a related LinkedIn profile at https://www.linkedin.com/in/abdulrahman-aldossary-842b6b26b/. No specific patch or mitigation guidance is detailed in the provided information.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote SQL injection in unauthenticated public-facing web app parameter enables initial access via exploitation of internet-facing service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2019-25636Shared CWE-89
CVE-2026-32611Shared CWE-89
CVE-2026-42755Shared CWE-89
CVE-2024-53544Shared CWE-89
CVE-2026-21410Shared CWE-89

Affected Assets

Linkedin
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of information inputs like the category parameter to reject malicious SQL code and directly prevent SQL injection exploitation.

SI-2 Flaw Remediation good match
preventrecover

Mandates timely remediation of flaws such as the SQL injection vulnerability in MODAPS v8.1 through patching or code fixes.

SC-7 Boundary Protection good match
preventdetect

Enforces boundary protection via mechanisms like web application firewalls to monitor and block SQL injection attempts over network access.

References