CVE-2024-12355

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function ContactBook::adding of the file ContactBook.cpp. The manipulation leads to improper input validation. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
SourceCodester	Phone Contact Manager System	1.0
razormist	phone_contact_manager_system	1.0

References

https://github.com/TinkAnet/cve/blob/main/BOF2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.287275Permissions Required
https://vuldb.com/?id.287275Third Party Advisory
https://vuldb.com/?submit.457864Third Party Advisory
https://www.sourcecodester.com/Product

Timeline

Published: Dec 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-123569.8A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthent CVE-2024-123575.3A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is CVE-2024-123588.8A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/j CVE-2024-123595.4A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code CVE-2024-12366.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St CVE-2024-123608.8A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects so CVE-2024-123624.3A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file CVE-2024-123637.1Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated CVE-2024-123649.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Sof CVE-2024-123658.5The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_CVE-2024-123669.8PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Co CVE-2024-123678.6Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory I