CVE-2024-41454 An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HT...

MediumCVSS 6.5 EPSS 0.47%

Published: 2025-01-15 02:30 (approximate time: when CVE Radar first recorded it)
Updated: 2026-06-17 10:47
Exploit status: No public exploit known

Description

An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HTML file.

Affected products

No affected product data has been published yet.

References

github.com

CVSS v3.1

6.5 Medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.47% (percentile 41.5)
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.