CVE-2024-7740

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
wanglongcn	ltcms	1.0.20
wanglongcn	ltcms	1.0.20

References

https://github.com/DeepMountains/Mirage/blob/main/CVE14-1.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.274360Permissions Required, Third Party Advisory
https://vuldb.com/?id.274360Permissions Required, Third Party Advisory
https://vuldb.com/?submit.386432Third Party Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-77415.3A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /a CVE-2024-77429.8A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file CVE-2024-77439.8A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downl CVE-2024-77446.5In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnera CVE-2024-77458.1In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows CVE-2024-77469.8Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.Thi CVE-2024-77476.5The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and inclu CVE-2024-77489.8A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknow CVE-2024-77495.4A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function CVE-2024-77507.5A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerab CVE-2024-77517.5A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some CVE-2024-77526.1A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as problematic. This affects an un