Total
4400 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-5043 | 1 Emlog | 1 Emlog | 2026-06-17 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2024-5008 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 8.8 HIGH |
| In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController. | |||||
| CVE-2024-58313 | 1 Xbtitfm | 1 Xbtitfm | 2026-06-17 | N/A | 7.2 HIGH |
| xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands. | |||||
| CVE-2024-58298 | 2026-06-17 | N/A | N/A | ||
| Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint. | |||||
| CVE-2024-58295 | 2026-06-17 | N/A | N/A | ||
| ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme installation process. Attackers can upload a ZIP archive with a PHP file containing system commands, which can then be executed by accessing the uploaded file in the theme directory. | |||||
| CVE-2024-58283 | 1 Wbce | 1 Wbce Cms | 2026-06-17 | N/A | 8.8 HIGH |
| WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter. | |||||
| CVE-2024-58282 | 1 S9y | 1 Serendipity | 2026-06-17 | N/A | 7.2 HIGH |
| Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server. | |||||
| CVE-2024-58281 | 1 Dotclear | 1 Dotclear | 2026-06-17 | N/A | 8.8 HIGH |
| Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file. | |||||
| CVE-2024-58279 | 1 Apprain | 1 Apprain | 2026-06-17 | N/A | 8.8 HIGH |
| appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory. | |||||
| CVE-2024-57968 | 1 Advantive | 1 Veracore | 2026-06-17 | N/A | 9.9 CRITICAL |
| Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this. | |||||
| CVE-2024-57761 | 1 Huayi-tec | 1 Jeewms | 2026-06-17 | N/A | 8.1 HIGH |
| An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2024-57668 | 1 Fabian | 1 Shopping Portal | 2026-06-17 | N/A | 8.8 HIGH |
| In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability. | |||||
| CVE-2024-57450 | 1 1000mz | 1 Chestnutcms | 2026-06-17 | N/A | 9.8 CRITICAL |
| ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. | |||||
| CVE-2024-57408 | 1 Beian.miit | 1 Cool-admin-java | 2026-06-17 | N/A | 7.2 HIGH |
| An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2024-57407 | 2026-06-17 | N/A | 7.3 HIGH | ||
| An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2024-57169 | 1 Soplanning | 1 Soplanning | 2026-06-17 | N/A | 9.8 CRITICAL |
| A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files. | |||||
| CVE-2024-56975 | 1 Invoiceplane | 1 Invoiceplane | 2026-06-17 | N/A | 9.8 CRITICAL |
| InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller. | |||||
| CVE-2024-56897 | 1 Yitechnology | 2 Yi Car Dashcam, Yi Car Dashcam Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset. | |||||
| CVE-2024-56829 | 2026-06-17 | N/A | 10.0 CRITICAL | ||
| Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx. | |||||
| CVE-2024-56828 | 1 1000mz | 1 Chestnutcms | 2026-06-17 | N/A | 9.8 CRITICAL |
| File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the base64-encoded image is parsed. For example, given a string like: data:image/html;base64,PGh0bWw+PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPjwvaHRtbD4= the content after the comma is extracted and decoded using Base64.getDecoder().decode(). The substring from the 11th character up to the first occurrence of a semicolon (;) is assigned to the suffix variable (representing the file extension). The decoded content is then written to a file. However, the file extension is not validated, and since this functionality is exposed to the frontend, it poses significant security risks. | |||||