CVE-2024-13210

A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of the file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController. java. The manipulation of the argument pictureFile leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-284
• CWE-434
• CWE-434

• https://github.com/donglight/bookstore/issues/10Exploit, Issue Tracking
• https://github.com/donglight/bookstore/issues/10#issue-2760923048Exploit, Issue Tracking
• https://vuldb.com/?ctiid.290815Permissions Required, VDB Entry
• https://vuldb.com/?id.290815Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.469686Third Party Advisory, VDB Entry

Published

Jan 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13205A vulnerability was found in kurniaramadhan E-Commerce-PHP 1…5.4
• CVE-2024-13206A vulnerability classified as critical has been found in REV…8.5
• CVE-2024-13207The Widget for Social Page Feeds WordPress plugin before 6.4…4.8
• CVE-2024-13208The Maps Plugin using Google Maps for WordPress WordPress p…4.3
• CVE-2024-13209A vulnerability was found in Redaxo CMS 5.18.1. It has been …5.4
• CVE-2024-1321The EventPrime – Events Calendar, Bookings and Tickets plugi…5.3
• CVE-2024-13211A vulnerability was found in SingMR HouseRent 1.0. It has be…8.8
• CVE-2024-13212A vulnerability classified as critical has been found in Sin…8.8
• CVE-2024-13213A vulnerability classified as problematic was found in SingM…5.4
• CVE-2024-13215The Elementor Addon Elements plugin for WordPress is vulnera…4.3
• CVE-2024-13216The HT Event – WordPress Event Manager Plugin for Elementor …4.3
• CVE-2024-13217The Jeg Elementor Kit plugin for WordPress is vulnerable to …4.3