How severe is CVE-2024-52305?

CVE-2024-52305 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-52305 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-52305?

CVE-2024-52305 affects Webkul Unopim. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-52305?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-52305 have an EU (EUVD) identifier?

Yes. CVE-2024-52305 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3235.

When was CVE-2024-52305 published?

CVE-2024-52305 was published on 2024-11-13 and last updated on 2026-06-17.

CVE-2024-52305

CVE-2024-52305 is a medium-severity vulnerability in Webkul Unopim with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-616.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-3235
Weakness: CWE-616
Affected product: Webkul Unopim
Published: 2024-11-13
Last modified: 2026-06-17

Description

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.

Frequently asked questions

What is CVE-2024-52305?: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.
How severe is CVE-2024-52305?: CVE-2024-52305 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-52305 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-52305?: CVE-2024-52305 affects Webkul Unopim. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-52305?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-52305 have an EU (EUVD) identifier?: Yes. CVE-2024-52305 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3235.
When was CVE-2024-52305 published?: CVE-2024-52305 was published on 2024-11-13 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:webkul:unopim:*:*:*:*:*:*:*:*

More vulnerabilities in Webkul Unopim

CVE-2025-55745 — High (CVSS 8.8): UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and…
CVE-2025-55743 — High (CVSS 8.8): UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the…
CVE-2025-55741 — High (CVSS 8.1): UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0…
CVE-2025-55742 — High (CVSS 8.0): UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1,…
CVE-2024-50637 — Medium (CVSS 5.4): UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers…
CVE-2025-55744 — Medium (CVSS 4.3): UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some…

All CVEs affecting Webkul Unopim →

Other CWE-616 vulnerabilities

CVE-2025-67084 — Critical (CVSS 9.9): File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files…
CVE-2024-31601 — Critical (CVSS 9.8): An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows…
CVE-2024-29858 — Critical (CVSS 9.8): In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid…
CVE-2025-59402 — Medium (CVSS 5.4): Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490…
CVE-2025-52130 — Medium (CVSS 5.4): File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw…

Browse all CWE-616 vulnerabilities →