CVE-2024-24551

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-434CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-245528.8A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or anCVE-2024-245537.5Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attCVE-2024-245548.2Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the useCVE-2024-245566.1urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit thCVE-2024-245577.8Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poiCVE-2024-245586.1TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-nexCVE-2024-245595.3Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. CoCVE-2024-24566.4The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all verCVE-2024-245605.3Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input CVE-2024-245619.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices doCVE-2024-245625.3vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issuCVE-2024-245639.8Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are define
CVE-2024-24551: High severity, CVSS 8.8 | Vulnix