CVE-2024-0465: code-projects employee_profile_management_system Path Traversal: '../filedir'

Vulnerability summary

CVE-2024-0465 is a medium (CVSS 5.3) Path Traversal: '../filedir' vulnerability in code-projects employee_profile_management_system. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-01-2024
   PublishedVulnerability first disclosed.
2. 16-06-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument download_file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-250570 is the identifier assigned to this vulnerability.

• CWE-24Path Traversal: '../filedir'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.