CVE-2024-11984criticalCWE-434

CVE-2024-11984: falha crítica em SUNNET Technology Co., Ltd.

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Corporate Training Management System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.8%
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
SUNNET Technology Co., Ltd. · Corporate Training Management System
CVEs relacionadas — SUNNET Technology Co., Ltd.

No mesmo produto, das mais perigosas para as menos.

CVE-2025-54944MEDIUMSUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous TypeEPSS 0.7%CVE-2026-24727CRITICALSUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous TypeEPSS 0.7%CVE-2025-54945CRITICALSUNNET Corporate Training Management System - External Control of File Name or PathEPSS 0.5%CVE-2025-54943CRITICALSUNNET Corporate Training Management System - Missing AuthorizationEPSS 0.5%CVE-2025-54946CRITICALSUNNET Corporate Training Management System - SQL InjectionEPSS 0.5%CVE-2025-54942CRITICALSUNNET Corporate Training Management System - Missing Authentication for Critical FunctionEPSS 0.5%