CVE-2024-1198

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-119808.6Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to dirCVE-2024-119817.5Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive conCVE-2024-119827.2Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator priCVE-2024-119837.2Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privCVE-2024-119848.8A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.1CVE-2024-119854.4An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router ImprCVE-2024-119869.6Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an AdministCVE-2024-11997.5A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerabilitCVE-2024-119904.6A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate CVE-2024-119916.5Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a fewCVE-2024-119929.1Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended rCVE-2024-119936.1Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows