CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

• CWE-59
• CWE-22

• https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlierVendor Advisory
• https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57728US Government Resource
• https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/Technical Description
• https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforceThird Party Advisory

Published

Jan 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-57722lunasvg v3.0.0 was discovered to contain a allocation-size-t…7.5
• CVE-2024-57723lunasvg v3.0.0 was discovered to contain a segmentation viol…6.5
• CVE-2024-57724lunasvg v3.0.0 was discovered to contain a segmentation viol…6.5
• CVE-2024-57725An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows …6.5
• CVE-2024-57726SimpleHelp remote support software v5.5.7 and before has a v…9.9
• CVE-2024-57727SimpleHelp remote support software v5.5.7 and before is vuln…7.5
• CVE-2024-5773A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-5774A vulnerability has been found in SourceCodester Stock Manag…9.8
• CVE-2024-5775A vulnerability was found in SourceCodester Vehicle Manageme…8.8
• CVE-2024-57757JeeWMS before v2025.01.01 was discovered to contain a permis…7.5
• CVE-2024-5776Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-57760JeeWMS before v2025.01.01 was discovered to contain a SQL in…6.5