CVE-2024-2561

A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controller/company/Index.php#sendCompanyLogo of the component Company Logo Handler. The manipulation of the argument imgBase64 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257060.

• CWE-434

• https://gist.github.com/Southseast/9f5284d8ee0f6d91e72eef73b285512aExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257060Permissions Required, VDB Entry
• https://vuldb.com/?id.257060Permissions Required, VDB Entry
• https://gist.github.com/Southseast/9f5284d8ee0f6d91e72eef73b285512aExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257060Permissions Required, VDB Entry
• https://vuldb.com/?id.257060Permissions Required, VDB Entry

Published

Mar 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25604Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported …6.5
• CVE-2024-25605The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, …5.3
• CVE-2024-25606XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, a…8.7
• CVE-2024-25607The default password hashing algorithm (PBKDF2-HMAC-SHA1) in…7.5
• CVE-2024-25608HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.…6.1
• CVE-2024-25609HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.…6.1
• CVE-2024-25610In Liferay Portal 7.2.0 through 7.4.3.12, and older unsuppor…5.4
• CVE-2024-25611Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2024-25612Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2024-25613Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2024-25614There is an arbitrary file deletion vulnerability in the CLI…9.1
• CVE-2024-25615 An unauthenticated Denial-of-Service (DoS) vulnerability ex…5.3