CVE-2024-39937

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/an/an/a
bluetronsupos5.0

References

Timeline

Published
Jul 4, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-39945.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutCVE-2024-399438.8rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if CVE-2024-399447.5A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, caCVE-2024-399454.9A vulnerability has been found in Dahua products.  After obtaining the administrator's username and password, the attacker can send a carefuCVE-2024-399467.2A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefullCVE-2024-399476.5A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefullCVE-2024-399487.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cCVE-2024-399497.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cCVE-2024-39952.0In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.CVE-2024-399509.8A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities toCVE-2024-399546.3CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker CVE-2024-39963.5The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege user
CVE-2024-39937: High severity, CVSS 7.5 | Vulnix