CVE-2024-58279

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
apprainappRain CMF4.0.5

References

Timeline

Published
Dec 10, 2025
Last modified
Sep 26, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-58289.8Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects HiCVE-2024-582808.8CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malCVE-2024-582818.8Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the mCVE-2024-582827.2Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files throCVE-2024-582838.8WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files throCVE-2024-582847.2PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP coCVE-2024-582855.4Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titleCVE-2024-582869.3dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG ExecutabCVE-2024-582878.8reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated atCVE-2024-582888.7Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. AttaCVE-2024-582895.4Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into CVE-2024-58293.5A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functional
CVE-2024-58279: High severity, CVSS 8.8 | Vulnix