CVE-2024-2754

A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257544.

• CWE-434

• https://github.com/wkeyi0x1/vul-report/issues/4Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.257544Permissions Required, VDB Entry
• https://vuldb.com/?id.257544Third Party Advisory, VDB Entry
• https://github.com/wkeyi0x1/vul-report/issues/4Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.257544Permissions Required, VDB Entry
• https://vuldb.com/?id.257544Third Party Advisory, VDB Entry

Published

Mar 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27529wasm3 139076a contains memory leaks in Read_utf8.8.4
• CVE-2024-2753Concrete CMS version 9 before 9.2.8 and previous versions pr…4.8
• CVE-2024-27530wasm3 139076a contains a Use-After-Free in ForEachModule.8.4
• CVE-2024-27532wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 0…7.5
• CVE-2024-27536Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-27537Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-27558Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scriptin…6.1
• CVE-2024-27559Stupid Simple CMS v1.2.4 was discovered to contain a Cross-S…6.3
• CVE-2024-2756Due to an incomplete fix to CVE-2022-31629 https://github.c…6.5
• CVE-2024-27561A Server-Side Request Forgery (SSRF) in the installUpdateThe…8.1
• CVE-2024-27563A Server-Side Request Forgery (SSRF) in the getFileFromRepo …5.3
• CVE-2024-27564pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc…6.5