CVE-2024-7438

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument aid leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-99 CWE-639

Affected software

Vendor	Product	Versions
SimpleMachines	SMF	2.1.4
simplemachines	simple_machines_forum	2.1.4

References

https://github.com/Fewword/Poc/blob/main/smf/smf-poc2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.273523Permissions Required, VDB Entry
https://vuldb.com/?id.273523Permissions Required, VDB Entry
https://vuldb.com/?submit.380190Third Party Advisory, VDB Entry

Timeline

Published: Aug 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-74399.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this issue is CVE-2024-74409.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the CVE-2024-74419.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability CVE-2024-74429.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects th CVE-2024-74439.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the functio CVE-2024-74449.8A vulnerability classified as critical was found in itsourcecode Ticket Reservation System 1.0. Affected by this vulnerability is an unknown CVE-2024-74457.2A vulnerability, which was classified as critical, has been found in itsourcecode Ticket Reservation System 1.0. Affected by this issue is s CVE-2024-74467.2A vulnerability, which was classified as critical, was found in itsourcecode Ticket Reservation System 1.0. This affects an unknown part of CVE-2024-74475.3The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un CVE-2024-74488.0Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut CVE-2024-74499.8A vulnerability, which was classified as critical, was found in itsourcecode Placement Management System 1.0. Affected is an unknown functio CVE-2024-74508.8A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this vulnerability is