CVE-2024-5355

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266267.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
anji-plus	AJ-Report	1.4.0; 1.4.1
anji-plus	report	>= 1.4.0, <= 1.4.1

References

https://github.com/anji-plus/report/files/15363269/aj-report.pdfExploit
https://github.com/anji-plus/report/issues/34Broken Link
https://vuldb.com/?ctiid.266267Permissions Required, VDB Entry
https://vuldb.com/?id.266267Permissions Required, VDB Entry
https://github.com/anji-plus/report/files/15363269/aj-report.pdfExploit
https://github.com/anji-plus/report/issues/34Broken Link
https://vuldb.com/?ctiid.266267Permissions Required, VDB Entry
https://vuldb.com/?id.266267Permissions Required, VDB Entry

Timeline

Published: May 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-535529.8CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.CVE-2024-535539.1An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests.CVE-2024-535548.0A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execut CVE-2024-535558.8A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file.CVE-2024-535566.1An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /log CVE-2024-53569.8A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file CVE-2024-535618.7A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a CVE-2024-535635.4A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web CVE-2024-535647.2A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-pr CVE-2024-535665.5An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execut CVE-2024-535685.4A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authentic CVE-2024-535695.4A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows auth