PatchTheCVEleptoncms vulnerabilities and fixes
Recent CVEs affecting leptoncms, with upgrade or downgrade steps. 5 tracked.
leptoncms has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-12-09. Highest priority: CVE-2024-24399 (score 54/100).
- CVE-2025-56704 HIGH 8.8 DOWNGRADE LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper
- CVE-2024-24520 HIGH 7.8 DOWNGRADE An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in t
- CVE-2024-29515 HIGH 8.8 DOWNGRADE File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code
- CVE-2024-29514 HIGH 8.8 DOWNGRADE File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code
- CVE-2024-24399 HIGH 7.2 DOWNGRADE An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PH
FAQ
How do I fix leptoncms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is leptoncms being exploited right now?
None of the tracked leptoncms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which leptoncms CVE should I patch first?
CVE-2024-24399 currently ranks highest (54/100): An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PH.