CVE-2024-24399
high · 7.2An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area.
7.2
CVSS
15.6%
EPSS (exploit prob.)
97th
EPSS percentile
2024-01-25
Published
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| lepton-cms | leptoncms | 7.0.0 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/capture0x/leptoncms
- https://github.com/capture0x/leptoncms/blob/main/README.md
- https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/51949
- https://github.com/capture0x/leptoncms
- https://github.com/capture0x/leptoncms/blob/main/README.md
- https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/51949
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2024-24399