CVE-2024-4945

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file view_parcel.php. The manipulation of the argument id leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264480.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Best Courier Management System	1.0

References

https://github.com/CveSecLook/cve/issues/28Exploit, Third Party Advisory
https://vuldb.com/?ctiid.264480Permissions Required, VDB Entry
https://vuldb.com/?id.264480Third Party Advisory, VDB Entry
https://vuldb.com/?submit.333960Third Party Advisory, VDB Entry
https://github.com/CveSecLook/cve/issues/28Exploit, Third Party Advisory
https://vuldb.com/?ctiid.264480Permissions Required, VDB Entry
https://vuldb.com/?id.264480Third Party Advisory, VDB Entry
https://vuldb.com/?submit.333960Third Party Advisory, VDB Entry

Timeline

Published: May 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-49468.8A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vul CVE-2024-49479.6Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf CVE-2024-49486.5Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-49496.5Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-49506.5Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage i CVE-2024-495015.7Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attack CVE-2024-495023.5A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy CVE-2024-495033.5A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers CVE-2024-495047.0grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.CVE-2024-495056.1A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allo CVE-2024-495067.3Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the enc CVE-2024-495077.8InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit