CVE-2024-7029

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Commands can be injected over the network and executed without authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-70304.3The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2024-70318.8The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check onCVE-2024-70326.5The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'CVE-2024-70356.9In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerCVE-2024-70416.5An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the APICVE-2024-70429.8A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompCVE-2024-70438.8An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application doesCVE-2024-70448.9A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An atCVE-2024-70475.4A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 priCVE-2024-70485.4In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST CVE-2024-70508.3Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular sceCVE-2024-70524.8The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege use
CVE-2024-7029: Critical severity, CVSS 9.8 | Vulnix