CVE-2024-1260

A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252999.

• CWE-434
• CWE-434

• https://note.zhaoj.in/share/H73DuWdyifaIBroken Link
• https://vuldb.com/?ctiid.252999Permissions Required, Third Party Advisory
• https://vuldb.com/?id.252999Third Party Advisory
• https://note.zhaoj.in/share/H73DuWdyifaIBroken Link
• https://vuldb.com/?ctiid.252999Permissions Required, Third Party Advisory
• https://vuldb.com/?id.252999Third Party Advisory

Published

Feb 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12594The Custom Login Page Styler – Login Protected Private Site …8.8
• CVE-2024-12595The AHAthat Plugin WordPress plugin through 1.6 does not esc…4.7
• CVE-2024-12596The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…4.3
• CVE-2024-12597The HT Mega – Absolute Addons For Elementor plugin for WordP…5.4
• CVE-2024-12598The MyBookProgress by Stormhill Media plugin for WordPress i…6.4
• CVE-2024-12599The HT Mega – Absolute Addons For Elementor plugin for WordP…6.4
• CVE-2024-12600The Custom Product Tabs Lite for WooCommerce plugin for Word…7.2
• CVE-2024-12601The Calculated Fields Form plugin for WordPress is vulnerabl…5.3
• CVE-2024-12602Identity verification vulnerability in the ParamWatcher modu…7.5
• CVE-2024-12603A logic vulnerability in the the mobile application (com.tra…9.8
• CVE-2024-12604Cleartext Storage of Sensitive Information in an Environment…6.5
• CVE-2024-12605The AI Scribe – SEO AI Writer, Content Generator, Humanizer,…4.3