References https://access.redhat.com/security/cve/cve-2024-42048 https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2024-42048 https://github.com/advisories/GHSA-qcm4-xfwp-vp6c https://socdefenders.ai/cves/CVE-2024-42048 https://www.redpacketsecurity.com/cve_alert_cve-2024-42048/ https://www.linkedin.com/posts/threatstats_openorange-businessframework-securitymisconfiguration-activity-7359268920924463104-A9lM https://vuldb.com/es/vuln/319178 https://www.nsfocus.net/index.php?act=sec_bug&type_id=&os=&keyword=&page=419
Related VulnerabilitiesPoCCVE-2026-39352: Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path TraversalPoCfrappe-default-login: Frappe Framework - Default Login Credentials力合科技-水质监测系统 /AutoData/Business/Report/WQDataCalculation.aspx/Api/ReportList 文件读取漏洞GoCD Cruise /go/add-on/business-continuity/api/cruise_config 信息泄露漏洞孚盟云CRM BusinessPriceReport.aspx SQL注入漏洞孚盟云 CRM /m/Dingding/Product/BusinessPriceReport.aspx SQL 注入漏洞PoCCVE-2025-41242: Spring Framework - Path Traversal孚盟云CRM /m/Dingding/Ajax/AjaxBusinessPrice.ashx GetBmailByFid SQL 注入漏洞PoCCVE-2024-38819: Spring Framework Path Traversal in Functional Web FrameworksLVS 精益价值管理系统 /Business/LoginVaild.aspx 文件读取漏洞PoC美特 CRM /business/common/toviewspecial.jsp 文件读取漏洞PoC孚盟云CRM /m/Dingding/Ajax/AjaxBusinessPriceActiveReports.ashx GetTempelateList SQL 注入漏洞PoCCVE-2024-13055: Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting