CVE-2024-0416
CVE-2024-0416 is a medium-severity vulnerability in Csdeshang Dsmall with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-24.
Key facts
- Severity: Medium (CVSS 3.x base score 5.4)
- CVSS v2: 5.5
- EPSS exploit prediction: 1% (57th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-16211
- Weakness: CWE-24
- Affected product: Csdeshang Dsmall
- Published:
- Last modified:
Description
A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436.
Frequently asked questions
- What is CVE-2024-0416?
- A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436.
- How severe is CVE-2024-0416?
- CVE-2024-0416 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
- Is CVE-2024-0416 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-0416?
- CVE-2024-0416 affects Csdeshang Dsmall. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-0416?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-0416 have an EU (EUVD) identifier?
- Yes. CVE-2024-0416 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-16211.
- When was CVE-2024-0416 published?
- CVE-2024-0416 was published on 2024-01-11 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:csdeshang:dsmall:*:*:*:*:*:*:*:*
More vulnerabilities in Csdeshang Dsmall
- CVE-2024-0415 — Medium (CVSS 6.3): A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an…
- CVE-2024-0411 — Medium (CVSS 5.3): A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown…
All CVEs affecting Csdeshang Dsmall →
Other CWE-24 vulnerabilities
- CVE-2026-39813 — Critical (CVSS 9.8): A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…
- CVE-2026-49103 — Critical (CVSS 9.4): Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component.…
- CVE-2025-61318 — Critical (CVSS 9.1): Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php…
- CVE-2023-6699 — Critical (CVSS 9.1): The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all…
- CVE-2025-54769 — High (CVSS 8.8): An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed…
- CVE-2025-60344 — High (CVSS 8.6): A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote…