CVE-2024-13144

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
zhenfeng13	My-Blog	1.0

References

https://github.com/ZHENFENG13/My-Blog/issues/140Exploit, Issue Tracking
https://github.com/ZHENFENG13/My-Blog/issues/140#issue-2759813820Exploit, Issue Tracking
https://vuldb.com/?ctiid.290232Permissions Required, VDB Entry
https://vuldb.com/?id.290232Third Party Advisory, VDB Entry
https://vuldb.com/?submit.469220Third Party Advisory, VDB Entry

Timeline

Published: Jan 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-131459.8A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the fil CVE-2024-131468.8The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logge CVE-2024-131479.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows CVE-2024-131489.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yukseloglu Filter B2B Login Platform a CVE-2024-131499.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Un CVE-2024-13158.8The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all CVE-2024-131509.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fayton Software and Consulting Service CVE-2024-131519.8CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Teleco CVE-2024-1315210.0Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Mo CVE-2024-131535.4The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions CVE-2024-131555.4The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split He CVE-2024-131566.4The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via t