CVE-2024-1116

A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller/Upload.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252474 is the identifier assigned to this vulnerability.

• CWE-434

• https://note.zhaoj.in/share/uCElTQRGWVywBroken Link, Third Party Advisory
• https://vuldb.com/?ctiid.252474Permissions Required, Third Party Advisory
• https://vuldb.com/?id.252474Third Party Advisory
• https://note.zhaoj.in/share/uCElTQRGWVywBroken Link, Third Party Advisory
• https://vuldb.com/?ctiid.252474Permissions Required, Third Party Advisory
• https://vuldb.com/?id.252474Third Party Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11154The PublishPress Revisions: Duplicate Posts, Submit, Approve…4.3
• CVE-2024-11155A “use after free” code execution vulnerability exists in t…8.5
• CVE-2024-11156An “out of bounds write” code execution vulnerability exist…7.8
• CVE-2024-11157A third-party vulnerability exists in the Rockwell Automatio…7.3
• CVE-2024-11158An “uninitialized variable” code execution vulnerability exi…8.5
• CVE-2024-11159Using remote content in OpenPGP encrypted messages can lead …4.3
• CVE-2024-11160Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-11165An information disclosure vulnerability exists in the backup…5.7
• CVE-2024-11166For TCAS II systems using transponders compliant with MOPS e…7.1
• CVE-2024-11167An improper access control vulnerability in danny-avila/libr…5.3
• CVE-2024-11168The urllib.parse.urlsplit() and urlparse() functions imprope…6.3
• CVE-2024-11169An unhandled exception in danny-avila/librechat version 3c94…7.5