CVE-2024-3112

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-311205.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gal CVE-2024-311216.5Contributor Cross Site Scripting (XSS) in HeartThis <= 0.1.0 versions.CVE-2024-311225.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prism IT Systems User Rights Access Ma CVE-2024-311237.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderFAQ allows Reflected X CVE-2024-311277.3An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their priv CVE-2024-31135.9The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escap CVE-2024-311346.5In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registratio CVE-2024-311356.1In JetBrains TeamCity before 2024.03 open redirect was possible on the login page CVE-2024-311367.4In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter CVE-2024-311376.1In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration CVE-2024-311385.4In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings CVE-2024-311398.1In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector