CVE-2024-25182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
givanz VvvebJs 1.7.2 suffers from a file upload vulnerability via save.php, which may allow an attacker to upload dangerous files.
Risk Assessment
Potential for remote code execution or server compromise by exploiting the file upload vulnerability.
Recommendation
Update VvvebJs to the latest version or restrict access to save.php and implement file upload validation.
Other vulnerabilities in VvvebJs
See all- CVE-2024-27480Critical
givanz VvvebJs 1.7.2 is vulnerable to insecure file upload, which may allow an attacker to upload malicious files to the server.
- CVE-2024-25181Critical
A critical vulnerability in givanz VvvebJs 1.7.2 allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. It stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
- CVE-2024-25183High
givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.
Original NVD description (English source)
givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS