CVE-2022-24252

HighCVSS 8.8/10Last modified Jul 9, 2026

Description

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 1, 2022
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-242538.8Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransfeCVE-2022-242548.8An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execCVE-2022-242558.8Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.CVE-2022-242599.8An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a cCVE-2022-24264.8The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users suchCVE-2022-242609.8A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.CVE-2022-242628.8The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackeCVE-2022-242639.8Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via tCVE-2022-242647.5Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word paramCVE-2022-242657.5Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_CVE-2022-242667.5Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameteCVE-2022-242726.5An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This