CVE-2024-2849

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257770 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Simple File Manager	1.0
sourcecodester	simple_file_manager	1.0

References

https://github.com/CveSecLook/cve/issues/1Exploit, Third Party Advisory
https://vuldb.com/?ctiid.257770Permissions Required, VDB Entry
https://vuldb.com/?id.257770Third Party Advisory, VDB Entry
https://vuldb.com/?submit.303123Third Party Advisory, VDB Entry
https://github.com/CveSecLook/cve/issues/1Exploit, Third Party Advisory
https://vuldb.com/?ctiid.257770Permissions Required, VDB Entry
https://vuldb.com/?id.257770Third Party Advisory, VDB Entry
https://vuldb.com/?submit.303123Third Party Advisory, VDB Entry

Timeline

Published: Mar 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-28509.8A vulnerability was found in Tenda AC15 15.03.05.18 and classified as critical. Affected by this issue is the function saveParentControlInfo CVE-2024-28519.8A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSam CVE-2024-285159.8Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of cs CVE-2024-285197.8A kernel handle leak issue in ProcObsrvesx.sys 4.0.0.49 in MicroWorld Technologies Inc eScan Antivirus could allow privilege escalation for CVE-2024-28529.8A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function saveParent CVE-2024-285206.5File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an at CVE-2024-285217.8SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obt CVE-2024-28539.8A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSamb CVE-2024-285359.8Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function.CVE-2024-285379.8Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.CVE-2024-28549.8A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /gofo CVE-2024-285459.8Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function.