CVE-2024-30849
CVE-2024-30849 is a critical-severity vulnerability in Donbermoy Complete E-commerce Site with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-98.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 1% (62nd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-28768
- Weakness: CWE-98
- Affected product: Donbermoy Complete E-commerce Site
- Published:
- Last modified:
Description
Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter in admin/products_photo.php.
Frequently asked questions
- What is CVE-2024-30849?
- Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter in admin/products_photo.php.
- How severe is CVE-2024-30849?
- CVE-2024-30849 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-30849 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-30849?
- CVE-2024-30849 affects Donbermoy Complete E-commerce Site. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-30849?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2024-30849 have an EU (EUVD) identifier?
- Yes. CVE-2024-30849 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-28768.
- When was CVE-2024-30849 published?
- CVE-2024-30849 was published on 2024-04-05 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:donbermoy:complete_e-commerce_site:1.0:*:*:*:*:*:*:*
More vulnerabilities in Donbermoy Complete E-commerce Site
- CVE-2024-2754 — Medium (CVSS 4.7): A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an…
All CVEs affecting Donbermoy Complete E-commerce Site →
Other CWE-98 (PHP Remote File Inclusion) vulnerabilities
- CVE-2025-25174 — Critical (CVSS 10.0): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…
- CVE-2012-10025 — Critical (CVSS 10.0): The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI)…
- CVE-2026-41228 — Critical (CVSS 9.9): Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint…
- CVE-2025-31340 — Critical (CVSS 9.9): A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course…
- CVE-2023-5199 — Critical (CVSS 9.9): The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and…
- CVE-2026-7515 — Critical (CVSS 9.8): The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0…
Browse all CWE-98 (PHP Remote File Inclusion) vulnerabilities →