CVE-2024-11984criticalCWE-434

CVE-2024-11984: fallo crítico en SUNNET Technology Co., Ltd.

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Corporate Training Management System

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.4epss 0.8%
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
SUNNET Technology Co., Ltd. · Corporate Training Management System
CVEs relacionadas — SUNNET Technology Co., Ltd.

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-54944MEDIUMSUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous TypeEPSS 0.7%CVE-2026-24727CRITICALSUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous TypeEPSS 0.7%CVE-2025-54945CRITICALSUNNET Corporate Training Management System - External Control of File Name or PathEPSS 0.5%CVE-2025-54943CRITICALSUNNET Corporate Training Management System - Missing AuthorizationEPSS 0.5%CVE-2025-54946CRITICALSUNNET Corporate Training Management System - SQL InjectionEPSS 0.5%CVE-2025-54942CRITICALSUNNET Corporate Training Management System - Missing Authentication for Critical FunctionEPSS 0.5%