CVE-2024-3804

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the file /Public/webuploader/0.1.5/server/fileupload2.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-380407.5There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to CVE-2024-380415.5Windows Kernel Information Disclosure VulnerabilityCVE-2024-380437.8PowerShell Elevation of Privilege VulnerabilityCVE-2024-380447.2DHCP Server Service Remote Code Execution VulnerabilityCVE-2024-380458.1Windows TCP/IP Remote Code Execution VulnerabilityCVE-2024-380467.8PowerShell Elevation of Privilege VulnerabilityCVE-2024-380477.8PowerShell Elevation of Privilege VulnerabilityCVE-2024-380486.5Windows Network Driver Interface Specification (NDIS) Denial of Service VulnerabilityCVE-2024-380498.1Windows Distributed Transaction Coordinator Remote Code Execution VulnerabilityCVE-2024-380507.8Windows Workstation Service Elevation of Privilege VulnerabilityCVE-2024-380517.8Windows Graphics Component Remote Code Execution VulnerabilityCVE-2024-380527.8Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-3804: Medium severity, CVSS 6.3 | Vulnix