CVE-2024-3436

A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerability.

• CWE-434

• https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.259630Permissions Required, VDB Entry
• https://vuldb.com/?id.259630Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.311919Third Party Advisory, VDB Entry
• https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.259630Permissions Required, VDB Entry
• https://vuldb.com/?id.259630Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.311919Third Party Advisory, VDB Entry

Published

Apr 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34354CMSaaSStarter is a SaaS template/boilerplate built with Svel…6.5
• CVE-2024-34355TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34356TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34357TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34358TYPO3 is an enterprise content management system. Starting i…5.3
• CVE-2024-34359llama-cpp-python is the Python bindings for llama.cpp. `llam…9.6
• CVE-2024-34360go-spacemesh is a Go implementation of the Spacemesh protoco…8.2
• CVE-2024-34361Pi-hole is a DNS sinkhole that protects devices from unwante…8.8
• CVE-2024-34362Envoy is a cloud-native, open source edge and service proxy.…5.9
• CVE-2024-34363Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-34364Envoy is a cloud-native, open source edge and service proxy.…6.5
• CVE-2024-34365** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vu…9.1