CVE-2024-23180

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary code by uploading a specially crafted SVG file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-231816.1Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29CVE-2024-231828.1Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0CVE-2024-231835.4Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29CVE-2024-231845.0Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is alCVE-2024-231857.5Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the messCVE-2024-231866.1E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. AttackerCVE-2024-231876.1Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. AttCVE-2024-231886.5Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. CoCVE-2024-231895.4Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploiCVE-2024-23196.1Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially craftCVE-2024-231905.4Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit thisCVE-2024-231915.4Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exp