High severity8.8NVD Advisory· Published Jun 10, 2024· Updated Jun 17, 2026

CVE-2024-36528

Description

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
nukeviet/nukevietPackagist	<= 4.5	—

Affected products

Vinades/Egovernment
cpe:2.3:a:nukeviet:egovernment:*:*:*:*:*:*:*:*
Range: <=1.2.02
Vinades/Nukeviet2 versions
cpe:2.3:a:nukeviet:nukeviet:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nukeviet:nukeviet:*:*:*:*:*:*:*:*range: <=4.5.05
- (no CPE)
ghsa-coords
pkg:composer/nukeviet/nukeviet
Range: <= 4.5

Patches

Vulnerability mechanics

References

mat4mee.notion.site/2-bug-chains-in-nukeViet-lead-to-RCE-bdd42b20b05a448fbe87c752b41bb15fnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-mhj4-vrcv-x4xcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-36528ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000