CVE-2024-50623

These software products allow users to upload files without proper validation, which attackers can exploit to upload malicious files and execute code on the server. This is a critical flaw because it gives attackers complete control over the affected system.

CWE-434 unrestricted file upload vulnerability in Cleo Harmony, VLTrader, and LexiCom versions before 5.8.0.21 permits unauthenticated or authenticated attackers to upload arbitrary files without extension or content validation, leading to remote code execution on the server. The attack requires network access to the upload interface but no special privileges or user interaction.