CVE-2024-7743

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
wanglongcn	ltcms	1.0.20
wanglongcn	ltcms	1.0.20

References

https://github.com/DeepMountains/Mirage/blob/main/CVE14-4.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.274363Permissions Required, Third Party Advisory
https://vuldb.com/?id.274363Permissions Required, Third Party Advisory
https://vuldb.com/?submit.386435Third Party Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-77446.5In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnera CVE-2024-77458.1In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows CVE-2024-77469.8Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.Thi CVE-2024-77476.5The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and inclu CVE-2024-77489.8A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknow CVE-2024-77495.4A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function CVE-2024-77507.5A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerab CVE-2024-77517.5A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some CVE-2024-77526.1A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as problematic. This affects an un CVE-2024-77537.5A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability a CVE-2024-77547.5A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some un CVE-2024-77558.2The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffi