CVE-2024-24398

CRITICAL

Stimulsoft Dashboards.php < 2024.1.2 - Path Traversal

Title source: rule

Description

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

Exploits (1)

nomisec WRITEUP
by trustcves · poc
https://github.com/trustcves/CVE-2024-24398

References (3)

Scores

CVSS v3 9.8
EPSS 0.3050
EPSS Percentile 96.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (2)
npm/stimulsoft-dashboards-js 0 - 2024.1.3npm
stimulsoft/dashboards.php < 2024.1.2
Published Feb 06, 2024
Tracked Since Feb 18, 2026