CVE-2024-4946

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/adminHome.php. The manipulation of the argument sliderpic leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264481 was assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Online Art Gallery Management System	1.0
sourcecodester	online_art_gallery_management_system	1.0

References

https://github.com/CveSecLook/cve/issues/29Exploit, Third Party Advisory
https://vuldb.com/?ctiid.264481Permissions Required, VDB Entry
https://vuldb.com/?id.264481Third Party Advisory, VDB Entry
https://vuldb.com/?submit.334215Third Party Advisory, VDB Entry
https://github.com/CveSecLook/cve/issues/29Exploit, Third Party Advisory
https://vuldb.com/?ctiid.264481Permissions Required, VDB Entry
https://vuldb.com/?id.264481Third Party Advisory, VDB Entry
https://vuldb.com/?submit.334215Third Party Advisory, VDB Entry

Timeline

Published: May 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-49479.6Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf CVE-2024-49486.5Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-49496.5Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-49506.5Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage i CVE-2024-495015.7Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attack CVE-2024-495023.5A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy CVE-2024-495033.5A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers CVE-2024-495047.0grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.CVE-2024-495056.1A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allo CVE-2024-495067.3Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the enc CVE-2024-495077.8InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit CVE-2024-495087.8InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit