CVE-2024-34982

CRITICAL NUCLEI

lylme_spage 1.9.5 - Arbitrary File Upload and Remote Code Execution via /include/file.php

Title source: llm

Exploitation Summary

CVE-2024-34982 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.

Nuclei Templates (1)

LyLme-Spage - Arbitary File Upload

HIGHVERIFIEDby DhiyaneshDk

FOFA: icon_hash="-282504889"

References (1)

Core 1

Core References

Broken Link, Exploit

https://github.com/n2ryx/CVE/blob/main/Lylme_pagev1.9.5.md

Scores

CVSS v3 9.8

EPSS 0.0467

EPSS Percentile 90.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

lylme/lylme_spage 1.9.5

Published May 17, 2024

Tracked Since Feb 18, 2026