CVE-2024-27480

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 29, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-274889.8Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain senCVE-2024-274897.5An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.CVE-2024-27495.9The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its CVE-2024-274978.8Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.CVE-2024-274996.5Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.CVE-2024-27505.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button widCVE-2024-275077.5libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.CVE-2024-275087.5Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.CVE-2024-27515.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_stCVE-2024-275157.2Osclass 5.1.2 is vulnerable to SQL Injection.CVE-2024-275169.8Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obCVE-2024-275175.4Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permi
CVE-2024-27480: Critical severity, CVSS 9.8 | Vulnix