CVE-2024-1925: Ctcms Upsys.php unrestricted upload

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-27 · updated 2026-06-17
Weakness: CWE-434

Description

A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254860.

Affected products

Ctcms: 2.1.2

References

https://docs.qq.com/doc/DQkVmRXBlbGNPZmlL
https://vuldb.com/?ctiid.254860
https://vuldb.com/?id.254860
https://docs.qq.com/doc/DQkVmRXBlbGNPZmlL
https://vuldb.com/?ctiid.254860
https://vuldb.com/?id.254860

Get alerted when CVE-2024-1925 or the next vulnerability affects your stack