CVE-2024-12074

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of automatic1111/stable-diffusion-webui version 1.10.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation.

• CWE-400

• https://huntr.com/bounties/6b44bfc2-31a7-4fe9-86fb-072c90a23642Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12069The Lexicata plugin for WordPress is vulnerable to Reflected…6.1
• CVE-2024-1207The WP Booking Calendar plugin for WordPress is vulnerable t…9.8
• CVE-2024-12070A Denial of Service (DoS) vulnerability exists in the file u…7.5
• CVE-2024-12071The Evergreen Content Poster – Auto Post and Schedule Your B…5.3
• CVE-2024-12072The Analytics Cat – Google Analytics Made Easy plugin for Wo…6.1
• CVE-2024-12073The Meteor Slides plugin for WordPress is vulnerable to Stor…5.4
• CVE-2024-12076The Target Video Easy Publish plugin for WordPress is vulner…6.1
• CVE-2024-12077The Booking Calendar and Booking Calendar Pro plugins for Wo…6.1
• CVE-2024-12078ECOVACS robot lawn mowers and vacuums use a shared, static s…6.3
• CVE-2024-12079ECOVACS robot lawnmowers store the anti-theft PIN in clearte…4.8
• CVE-2024-1208The LearnDash LMS plugin for WordPress is vulnerable to Sens…5.3
• CVE-2024-12082in OpenHarmony v4.0.0 and prior versions allow a local attac…5.5