CVE-2024-25182
CriticalSummary
givanz VvvebJs 1.7.2 suffers from a file upload vulnerability via save.php, which may allow an attacker to upload dangerous files.
Risk Assessment
Potential for remote code execution or server compromise by exploiting the file upload vulnerability.
Recommendation
Update VvvebJs to the latest version or restrict access to save.php and implement file upload validation.
Other vulnerabilities in VvvebJs
See all- CVE-2024-27480Critical
givanz VvvebJs 1.7.2 is vulnerable to insecure file upload, which may allow an attacker to upload malicious files to the server.
- CVE-2024-25181Critical
A critical vulnerability in givanz VvvebJs 1.7.2 allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. It stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
Original NVD description (English source)
givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.