CVE-2024-9916: fallo de gravedad media en HuangDou UTCMS
HuangDou UTCMS cli.php os command injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
72Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 6.9epss 74%
de la publicación al arma
Publicada en NVD13 oct
VulnCheck+128d
A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
HuangDou · UTCMSCVEs relacionadas — HuangDou UTCMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-9917MEDIUMHuangDou UTCMS template_creat.php deserializationEPSS 8.8%CVE-2024-9918MEDIUMHuangDou UTCMS sql.php RunSql sql injectionEPSS 0.6%CVE-2025-9401MEDIUMHuangDou UTCMS Login login.php comparisonEPSS 0.4%CVE-2025-9402MEDIUMHuangDou UTCMS Config update.php server-side request forgeryEPSS 0.4%