Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-24520 Details

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place.

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/capture0x/leptoncms	CVE	Exploit
https://github.com/xF9979/LEPTON-CMS	CVE	Broken Link
https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html	CVE	Exploit
https://www.exploit-db.com/exploits/51949	CVE	Exploit
https://github.com/capture0x/leptoncms	[email protected]	Exploit
https://github.com/xF9979/LEPTON-CMS	[email protected]	Broken Link
https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html	[email protected]	Exploit
https://www.exploit-db.com/exploits/51949	[email protected]	Exploit

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	CISA-ADP

Product	Versions
lepton-cms leptoncms	7.0.0
CPE cpe:2.3:a:lepton-cms:leptoncms:7.0.0:::::::* Remediation No remediation found in references.

10 change records found show changes

QUICK INFO