CVE-2024-46088

CriticalCVSS 9.8/10Last modified Jul 5, 2026

Description

An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2024 allows attackers to execute arbitrary code via uploading a crafted file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
zhejiang_university	entersoft_customer_resource_management	>= 2002, <= 2024

References

Timeline

Published: Oct 11, 2024
Last modified: Jul 5, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-460896.374cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.CVE-2024-46099.8A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a maliciou CVE-2024-460978.1TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an inc CVE-2024-46107.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to m CVE-2024-461019.8GDidees CMS <= v3.9.1 has a file upload vulnerability.CVE-2024-461039.8SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.CVE-2024-46118.1The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCoo CVE-2024-46126.1An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.CVE-2024-46155.4The Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import:CVE-2024-46166.1The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to CVE-2024-46176.4The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in version CVE-2024-46185.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versi