CVE-2024-10505

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-10505

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10505.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-10505

Published

2024-10-30T01:31:04.245Z

Modified

2026-07-15T01:49:06.622671728Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

wuzhicms block.php edit code injection

Details

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10505.json"
}

References

Affected packages

Git / github.com/wuzhicms/wuzhicms

Affected ranges

Type

GIT

Repo

https://github.com/wuzhicms/wuzhicms

Events

Introduced

0a9144f8da632bbf69d53e4126bc2b6c0b08ee0d

Last affected

0a9144f8da632bbf69d53e4126bc2b6c0b08ee0d

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        }
    ],
    "cpe": "cpe:2.3:a:wuzhicms:wuzhicms:4.1.0:*:*:*:*:*:*:*"
}

Affected versions

4.*

4.1.0

v4.*

v4.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10505.json"