CVE-2024-2148

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255501 was assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-214809.8Memory corruption while playing audio file having large-sized input buffer.CVE-2024-214818.4Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.CVE-2024-214827.8Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs imag CVE-2024-214834.6A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufacture CVE-2024-214845.9Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. CVE-2024-214855.4Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packa CVE-2024-214889.8Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function wit CVE-2024-214898.2Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the CVE-2024-21497.2A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of t CVE-2024-214907.5This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split th CVE-2024-214916.5Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures o CVE-2024-214928.1All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessio