CVE-2024-48239

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting (XSS).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
wtcms_project	wtcms	1.0

References

https://github.com/taosir/wtcms/issues/16Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Oct 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-48249.8Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters grou CVE-2024-482415.5An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function.CVE-2024-482457.2Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative CVE-2024-482465.4Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/book CVE-2024-482488.6NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l CVE-2024-482497.3Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-48259.8A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via p CVE-2024-482519.8Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-482539.8Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.CVE-2024-482559.8Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.CVE-2024-482579.8Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.CVE-2024-482597.3Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.