CVE-2017-14838

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Sep 28, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-148398.8TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.CVE-2017-14844.3IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain informatCVE-2017-148408.8TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.CVE-2017-148416.5Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.CVE-2017-148428.8Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-148438.8Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-148448.8Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-148458.8Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-148468.8Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-148478.8Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-148488.8WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.CVE-2017-148497.5Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the p
CVE-2017-14838: High severity, CVSS 8.8 | Vulnix