CVE-2024-52305

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-616CWE-692

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-523069.8FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes paramCVE-2024-523075.6authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possibCVE-2024-523089.6The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codCVE-2024-523095.1SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerfulCVE-2024-52316.5A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue isCVE-2024-523116.3Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue CVE-2024-523125.4Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operCVE-2024-523134.3An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resCVE-2024-523144.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data frCVE-2024-523169.8Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) SCVE-2024-523176.5Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requesCVE-2024-523186.1Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are