CloudMap 漏洞情报库

高危CVE-2024-577282026/09/30KEV

SimpleHelp <= 5.5.7 - Arbitrary File Upload

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. This template is a version-based check: it reads the version banner exposed by the vendor's own /allversions page and flags branches that predate the January 2025 fixes.

simplehelpPoC 已收录

CVSS—

严重CVE-2024-577262026/09/30KEV

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access.

simplehelpPoC 已收录

CVSS—

严重CVE-2026-485582026/09/30KEV

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp <= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured.

simplehelpPoC 已收录

CVSS—

严重CVE-2024-577272025/01/15

SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

simplehelpPoC 已收录

CVSS7.5EPSS 93.9%

simplehelp

关联漏洞

SimpleHelp <= 5.5.7 - Arbitrary File Upload

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal