CVE-2024-2406

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256503.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-240605.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.CVE-2024-240615.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.CVE-2024-240625.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.CVE-2024-24085.9The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Ma CVE-2024-24099.8The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to i CVE-2024-240919.8Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.CVE-2024-240927.8SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php.CVE-2024-240939.8SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Up CVE-2024-240959.8Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection.CVE-2024-240967.8Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN.CVE-2024-240975.4Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News F CVE-2024-240987.8Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed.