CVE-2024-54852

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-90

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.mdExploit, Third Party Advisory
https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.mdExploit, Third Party Advisory

Timeline

Published: Jan 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-548535.4A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows r CVE-2024-548556.4fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly exe CVE-2024-54864.9A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive informatio CVE-2024-54878.8Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export opt CVE-2024-548799.1SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members i CVE-2024-54889.8The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injectio CVE-2024-548809.1SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts CVE-2024-548878.0TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /user CVE-2024-54894.3The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o CVE-2024-54908.8Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option.CVE-2024-549078.8TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc.CVE-2024-549098.1A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpo