CVE-2024-50648

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
yshopmall	yshopmall	1.0

References

https://github.com/Yllxx03/CVE/blob/main/yshop_fileu_pload.mdExploit, Third Party Advisory
https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50648Exploit, Third Party Advisory

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-506499.8The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.CVE-2024-50659.8A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function o CVE-2024-506507.5python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different I CVE-2024-506516.5java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs CVE-2024-506524.3A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.CVE-2024-506537.5CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once CVE-2024-506547.5lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturi CVE-2024-506555.4emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published artic CVE-2024-506566.1itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.CVE-2024-506576.8An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, spec CVE-2024-506589.8Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBill CVE-2024-506596.1Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shipping