CVE-2024-3736

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /adminPage/main/upload. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260575.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-373604.4Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2024-373619.9The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)   Hitachi CVE-2024-373626.3The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception CVE-2024-373636.5The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)  HitacCVE-2024-373646.8Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensiCVE-2024-373657.8A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public direCVE-2024-373677.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remotCVE-2024-373687.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote syCVE-2024-373698.8A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassingCVE-2024-37379.8A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountCVE-2024-373707.5In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, caCVE-2024-373719.1In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message