CVE-2024-6117

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
Hamastar TechnologyMeetingHub Paperless Meetings2021
hamastarmeetinghub_paperless_meetings2021

References

Timeline

Published
Aug 5, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-61189.1A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackersCVE-2024-61197.5Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalCVE-2024-61206.5The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capabilityCVE-2024-61217.8An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. ThiCVE-2024-61225.5An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in informationCVE-2024-61237.2The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function iCVE-2024-61245.4Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victiCVE-2024-61258.1The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. ThisCVE-2024-61263.2A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenvCVE-2024-61279.8BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated atCVE-2024-61285.3A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of tCVE-2024-61293.7A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login o