CVE-2024-9917: HuangDou UTCMS template_creat.php deserialization

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-13 · updated 2026-06-17
Weakness: CWE-502

Description

A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/template_creat.php. The manipulation of the argument content leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Usualtoolcms: 9.0

References

https://github.com/DeepMountains/zzz/blob/main/CVE5-2.md
https://vuldb.com/?ctiid.280245
https://vuldb.com/?id.280245
https://vuldb.com/?submit.418749

Get alerted when CVE-2024-9917 or the next vulnerability affects your stack