First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-24029

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-24035.9Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attac CVE-2024-240346.1Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary CVE-2024-240356.1Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.CVE-2024-24045.4The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users s CVE-2024-240416.1A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar CVE-2024-240428.8Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDir CVE-2024-240435.5Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted fil CVE-2024-24054.5The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in ad CVE-2024-240504.7Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters fir CVE-2024-240515.5Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts t CVE-2024-240595.4springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files.CVE-2024-24069.8A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/ad

CVE-2024-24029: Critical severity, CVSS 9.8 | Vulnix