CVE Watch14 de ago. de 2026

CVE-2017-11357

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

CVSS

9.8

Crítica

EPSS

77.7%

p100

KEV

SIM

26 de jan. de 2023

Exploit Today

0-100

Publicado: 23 de ago. de 2017 · Última mod.: 14 de ago. de 2026 · CWE-434

EPSS · 30d

77.7%EPSS · 30 dias77.7%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Telerik / User Interface (UI) for ASP.NET AJAX

Vulnerabilidade

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Adicionado ao KEV

26 de jan. de 2023

Corrigir até

16 de fev. de 2023

Uso conhecido em ransomware

Sim

Descrição resumida

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

Ação necessária

Apply updates per vendor instructions.

Notas

https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357

Descrição técnica

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1220477.3 ALT

22.2%

——7A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.1d CVE-2026-1221209.0 CRÍ

43.9%

——13In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.5h CVE-2026-1152436.7 MÉD

23.9%

——7The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.1d CVE-2026-1217335.4 MÉD

7.8%

——2Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.1d CVE-2026-733287.2 ALT

53.6%

——16Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.2d CVE-2026-761248.8 ALT

38.2%

——11The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.2d