CVE-2024-10505

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	wuzhicms	4.1.0
wuzhicms	wuzhicms	4.1.0

References

https://github.com/wuzhicms/wuzhicms/issues/209Exploit, Third Party Advisory
https://vuldb.com/?ctiid.282444Permissions Required, VDB Entry
https://vuldb.com/?id.282444Third Party Advisory, VDB Entry
https://vuldb.com/?submit.427401Third Party Advisory, VDB Entry

Timeline

Published: Oct 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-105067.2A vulnerability classified as critical has been found in code-projects Blood Bank System 1.0. This affects an unknown part of the file /admi CVE-2024-105079.8A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknow CVE-2024-105089.8The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation v CVE-2024-105099.8A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects som CVE-2024-10516.4The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versio CVE-2024-105104.8The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which CVE-2024-105115.3CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo CVE-2024-105137.2A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version CVE-2024-105153.5In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to imple CVE-2024-105168.1The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via CVE-2024-105174.8The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 CVE-2024-105184.8The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15