CVE-2022-24984

Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 84%
VendorProductVersion
jqueryformjqueryform
𝑥
< 2022-02-05
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://JQueryForm.com
https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560
https://www.nou-systems.com/cyber-security
https://JQueryForm.com
https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560
https://www.nou-systems.com/cyber-security