CVE-2024-33120

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows attackers to execute arbitrary code via a crafted JSP file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
n/an/an/a
roothub_projectroothub2.5

References

Timeline

Published
May 7, 2024
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-331216.3Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.CVE-2024-331226.3Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function.CVE-2024-331249.8Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function..CVE-2024-33138.4SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021.CVE-2024-331397.5J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function.CVE-2024-33149.8A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unCVE-2024-331448.8J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function inCVE-2024-331469.1J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.CVE-2024-331478.8J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function.CVE-2024-331487.3J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function.CVE-2024-331498.1J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function.CVE-2024-33159.8A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been classified as critical. Affected is an un
CVE-2024-33120: Critical severity, CVSS 9.8 | Vulnix