CVE-2024-7729

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

VendorProductVersions
CAYIN TechnologySMP-21003.0
CAYIN TechnologySMP-2200>= 3.0, <= 4.0
CAYIN TechnologySMP-2210>= 3.0, <= 4.0
CAYIN TechnologySMP-2300>= 3.0, <= 4.0
CAYIN TechnologySMP-2310>= 3.0, <= 4.0
CAYIN TechnologySMP-60003.0
CAYIN TechnologySMP-80003.0
CAYIN TechnologySMP-8000QD3.0
CAYIN TechnologyCMS-2011.0
CAYIN TechnologyCMS-6011.0
CAYIN TechnologyCMS-SE11.0
CAYIN TechnologyCMS-SE(18.04)11.0
CAYIN TechnologyCMS-SE(22.04)11.0
CAYIN TechnologySMP-81004.0
CAYIN TechnologySMP-24004.0
cayintechsmp-21003.0
cayintechsmp-2200>= 3.0, <= 4.0
cayintechsmp-2210>= 3.0, <= 4.0
cayintechsmp-2300>= 3.0, <= 4.0
cayintechsmp-2310>= 3.0, <= 4.0
cayintechsmp-60003.0
cayintechsmp-80003.0
cayintechsmp-8000qd3.0
cayintechcms-2011.0
cayintechcms-6011.0
cayintechcms-se11.0
cayintechcms-se\(18.04\)11.0
cayintechcms-se\(22.04\)11.0
cayintechsmp-81004.0
cayintechsmp-24004.0

References

Timeline

Published
Aug 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-77307.8A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcmCVE-2024-77319.8Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inCVE-2024-77329.8Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inCVE-2024-77335.4A vulnerability, which was classified as problematic, was found in FastCMS up to 0.1.5. Affected is an unknown function of the component NewCVE-2024-77345.3An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCPCVE-2024-77359.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry ReserCVE-2024-77365.4A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x throCVE-2024-77378.7A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCECVE-2024-77387.8A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknCVE-2024-77396.1A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipuCVE-2024-77409.8A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of thCVE-2024-77415.3A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /a
CVE-2024-7729: High severity, CVSS 7.5 | Vulnix