CVE-2024-0195

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	spider-flow	0.4.3

References

https://github.com/laoquanshi/puppy/blob/main/spider-flow%20code%20injection%20causes%20rce.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.249510Third Party Advisory
https://vuldb.com/?id.249510Third Party Advisory
https://github.com/laoquanshi/puppy/blob/main/spider-flow%20code%20injection%20causes%20rce.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.249510Third Party Advisory
https://vuldb.com/?id.249510Third Party Advisory

Timeline

Published: Jan 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-01968.8A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionali CVE-2024-01977.8A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level v CVE-2024-01998.0An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 p CVE-2024-02009.8An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability co CVE-2024-02014.3The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2024-02025.9A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key ex CVE-2024-02038.8The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing CVE-2024-02049.8Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration p CVE-2024-02067.8A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local us CVE-2024-02077.5HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02087.5GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted captu CVE-2024-02097.5IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafte