CVE-2024-25006

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 29, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-250077.1Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper NeCVE-2024-250086.8Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbCVE-2024-250096.5Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validatCVE-2024-25017.5The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, anCVE-2024-250108.8Ericsson RAN Compute and Site Controller 6610 contains in certain configurations a high severity vulnerability where improper input validatiCVE-2024-250115.3Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configuredCVE-2024-250157.5IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that CVE-2024-250167.5IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service dueCVE-2024-250199.8IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to JournaCVE-2024-25022.0An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. ThisCVE-2024-250209.8IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments iCVE-2024-250218.4IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands
CVE-2024-25006: High severity, CVSS 8.1 | Vulnix