CVE Watch8 de out. de 2026

CVE-2024-50623

Cleo Multiple Products Unrestricted File Upload Vulnerability

CVSS

9.8

Crítica

EPSS

98.6%

p100

KEV

SIM

13 de dez. de 2024

Exploit Today

0-100

Publicado: 28 de out. de 2024 · Última mod.: 8 de out. de 2026 · CWE-434

EPSS · 30d

98.6%EPSS · 30 dias98.6%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Cleo / Multiple Products

Vulnerabilidade

Cleo Multiple Products Unrestricted File Upload Vulnerability

Adicionado ao KEV

13 de dez. de 2024

Corrigir até

3 de jan. de 2025

Uso conhecido em ransomware

Sim

Descrição resumida

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update ; https://nvd.nist.gov/vuln/detail/CVE-2024-50623

Descrição técnica

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1220477.3 ALT

22.2%

——7A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.1d CVE-2026-1221209.0 CRÍ

43.9%

——13In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.5h CVE-2026-1152436.7 MÉD

23.9%

——7The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.1d CVE-2026-1217335.4 MÉD

7.8%

——2Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.1d CVE-2026-733287.2 ALT

53.6%

——16Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.2d CVE-2026-761248.8 ALT

38.2%

——11The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.2d