CVE-2024-24520

HighCVSS 7.8/10Last modified Jul 9, 2026

Description

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
n/an/an/a
lepton-cmsleptoncms7.0.0

References

Timeline

Published
Mar 21, 2024
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-245248.8Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.phCVE-2024-245259.8An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parametCVE-2024-24536.4There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL cCVE-2024-245395.3FusionPBX before 5.2.0 does not validate a session.CVE-2024-24546.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.CVE-2024-245439.8Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attackerCVE-2024-245486.5Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise usCVE-2024-245497.5Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, ifCVE-2024-24555.4The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via tCVE-2024-245508.1A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files throughCVE-2024-245518.8A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. ThCVE-2024-245528.8A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or an
CVE-2024-24520: High severity, CVSS 7.8 | Vulnix