Is CVE-2024-13174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-13174 being exploited in the wild.

How severe is CVE-2024-13174?

High severity, with a CVSS score of 8.6, published 16 September 2025.

Which products and versions are affected?

E1 Informatics Web Application through 20250916.

Is there a fix for CVE-2024-13174?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-13174 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-13174?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-13174: E1 Informatics Web Application SQL injection

CVE-2024-13174 · Severity: high · CVSS 8.6 · Published 2025-09-16

A security vulnerability exists in the E1 Informatics Web Application that could allow unauthorized individuals to interfere with the application's database. By exploiting this flaw, an attacker could potentially access sensitive customer data, modify records, or disrupt business operations. As of the latest report, the vendor has not confirmed a fix, posing a significant risk to organizations using this software.

Quick answers

Is CVE-2024-13174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-13174 being exploited in the wild.
How severe is CVE-2024-13174?: High severity, with a CVSS score of 8.6, published 16 September 2025.
Which products and versions are affected?: E1 Informatics Web Application through 20250916.
Is there a fix for CVE-2024-13174?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-13174 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-13174?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The E1 Informatics Web Application is vulnerable to SQL injection (CWE-89) due to improper neutralization of special elements used in SQL commands. This vulnerability can be exploited by a remote, unauthenticated attacker over the network without any user interaction. Successful exploitation allows the attacker to read sensitive data from the database, modify or delete data, and potentially gain administrative access to the application. At the time of disclosure, the vendor had not provided information regarding a patch or mitigation, and the vulnerability is confirmed to affect versions through 20250916.

Affected products

E1 Informatics Web Application through 20250916

Timeline

2025-09-16: disclosed: Initial disclosure by USOM/TR-CERT
2025-09-16: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.