CVE-2024-29272

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-292736.1There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.CVE-2024-292759.8SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive i CVE-2024-292769.8An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDes CVE-2024-292786.5funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ."CVE-2024-29287.5A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3 CVE-2024-29297.8A memory corruption vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauth CVE-2024-29291An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE:CVE-2024-292929.1Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to exe CVE-2024-292965.3A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference CVE-2024-29309.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. Affected by this vulnerability is an u CVE-2024-293017.5SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id=CVE-2024-293027.5SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.