CVE-2024-24216

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/easysoft/zentaopms/issues/133Issue Tracking
https://github.com/l3s10n/ZenTaoPMS_RCEExploit, Third Party Advisory
https://github.com/easysoft/zentaopms/issues/133Issue Tracking
https://github.com/l3s10n/ZenTaoPMS_RCEExploit, Third Party Advisory

Timeline

Published: Feb 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-24228.8LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including CVE-2024-24236.4The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnera CVE-2024-242307.5Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attacker CVE-2024-24247.5An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonr CVE-2024-242457.8An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the CVE-2024-242465.5Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/CVE-2024-24257.5A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploi CVE-2024-242544.2PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability i CVE-2024-242554.2A Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send d CVE-2024-242565.9SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain s CVE-2024-242577.5An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information v CVE-2024-242587.5freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.