CVE-2024-41577 - An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file

Back Back to CVE browser

CRITICAL

An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file

Published Aug 9, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.97%

Description

An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

Affected products

Vendor Productinfoquick Product Productinfoquick Default
unknown
Affected
- 1.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Productinfoquick	Productinfoquick	unknown	Affected 1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39079		Advisory
https://github.com/SENVIEL/learun-upload_file/issues/1

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 9, 2024

Updated Nov 5, 2024

Reserved Jul 18, 2024

Link CVE-2024-41577

CISA Vulnrichment

Updated Nov 5, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-41577

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Aug 9, 2024

Updated Nov 5, 2024

Link EUVD-2024-39079

GitHub

No data