CVE-2024-50648

CVSS 9.8 CRITICALEPSS 1.0%CWE-22

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

15 Nov 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

References

https://github.com/Yllxx03/CVE/blob/main/yshop_fileu_pload.md https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50648