CVE-2024-0864

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Leo Khoa	Laragon	<= *
leokhoa	laragon	<= *

References

https://cert.pl/en/posts/2024/02/CVE-2024-0864Third Party Advisory
https://cert.pl/posts/2024/02/CVE-2024-0864Third Party Advisory
https://laragon.org/Product
https://cert.pl/en/posts/2024/02/CVE-2024-0864Third Party Advisory
https://cert.pl/posts/2024/02/CVE-2024-0864Third Party Advisory
https://laragon.org/Product

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-08657.8CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrati CVE-2024-08668.1The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via t CVE-2024-08678.1The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check CVE-2024-08685.3The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to CVE-2024-08696.5The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized CVE-2024-08705.3The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on CVE-2024-08715.4The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link CVE-2024-08724.3The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-CVE-2024-08735.4The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all version CVE-2024-08745.3A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.CVE-2024-08754.8A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into th CVE-2024-08794.3Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not