CVE-2024-8875

A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder.php. The manipulation of the argument p leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/acmglz/bug2_report/blob/main/wcms%20has%20arbitrary%20file%20deletion.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.277507Permissions Required
• https://vuldb.com/?id.277507Third Party Advisory
• https://vuldb.com/?submit.404206Third Party Advisory

Published

Sep 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8869A vulnerability classified as critical has been found in TOT…8.1
• CVE-2024-8870The Forms for Mailchimp by Optin Cat – Grow Your MailChimp L…6.1
• CVE-2024-8871The Pricing Tables WordPress Plugin – Easy Pricing Tables pl…6.1
• CVE-2024-8872The Store Hours for WooCommerce plugin for WordPress is vuln…6.1
• CVE-2024-8873The PeproDev WooCommerce Receipt Uploader plugin for WordPre…6.1
• CVE-2024-8874The AJAX Login and Registration modal popup + inline form pl…6.1
• CVE-2024-8876A vulnerability, which was classified as problematic, has be…7.5
• CVE-2024-8877Improper neutralization of special elements results in a SQL…9.8
• CVE-2024-8878The password recovery mechanism for the forgotten password i…9.8
• CVE-2024-8880A vulnerability classified as critical has been found in pla…9.8
• CVE-2024-8881A post-authentication command injection vulnerability in the…6.8
• CVE-2024-8882A buffer overflow vulnerability in the CGI program in the Zy…4.5