CVE-2024-13982

SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.

• CWE-22

• https://blog.csdn.net/qq_36618918/article/details/135505570
• https://sponcomm.com/collections/ip-intercom-system
• https://www.vulncheck.com/advisories/spon-ip-network-intercom-system-arbitrary-file-read

Published

Aug 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13976A DLL injection vulnerability exists in Commvault for Window…8.5
• CVE-2024-13978A vulnerability was found in LibTIFF up to 4.7.0. It has bee…2.5
• CVE-2024-13979A SQL injection vulnerability exists in the St. Joe ERP syst…9.8
• CVE-2024-1398The Ultimate Bootstrap Elements for Elementor plugin for Wor…6.4
• CVE-2024-13980H3C Intelligent Management Center (IMC) versions up to and i…10
• CVE-2024-13981LiveBOS, an object-oriented business architecture middleware…10
• CVE-2024-13983Inappropriate implementation in Lens in Google Chrome on iOS…6.3
• CVE-2024-13984QiAnXin TianQing Management Center versions up to and includ…10
• CVE-2024-13985A command injection vulnerability in Dahua EIMS versions pri…10
• CVE-2024-13986Nagios XI < 2024R1.3.2 contains a remote code execution vuln…8.8
• CVE-2024-13987Improper neutralization of input during web page generation …5.9
• CVE-2024-1399The Restaurant Menu – Food Ordering System – Table Reservati…6.4