CVE-2024-57728

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 15, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Apr 24, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-57739.8A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown fuCVE-2024-57749.8A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Affected by this vulnerability is aCVE-2024-57758.8A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as critical. Affected by this issue is some unknownCVE-2024-577577.5JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.CVE-2024-577606.5JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.CVE-2024-577618.1An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code viaCVE-2024-577627.5MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.CVE-2024-577639.1MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.CVE-2024-577649.1MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.CVE-2024-577657.5MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.CVE-2024-577669.1MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.CVE-2024-577678.6MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.