CVE-2024-10201 HIGH

CVE-2024-10201: Wellchoose Administrative Management System - Arbitrary File Upload

Vendor Wellchoose
Product Administrative Management System
Weakness CWE-434 · Unrestricted file upload
Published October 21, 2024
Last update October 21, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.

Key dates

02Disclosure timeline

October 21, 2024 CVE published
October 21, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-7537 MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter CVE-2021-41566 Tad TadTools - Arbitrary File Upload CVE-2025-26927 WordPress AI Hub plugin <= 1.3.7 - Arbitrary File Upload vulnerability CVE-2023-0918 codeprojects Pharmacy Management System Avatar Image add.php unrestricted upload CVE-2024-13134 ZeroWdd studentmanager TeacherController. java editTeacher unrestricted upload