CVE-2024-53564

A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.

• CWE-434

• https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903Third Party Advisory
• https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8cThird Party Advisory

Published

Dec 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53554A Client-Side Template Injection (CSTI) vulnerability in the…8
• CVE-2024-53555A CSV injection vulnerability in Taiga v6.8.1 allows attacke…8.8
• CVE-2024-53556An Open Redirect vulnerability in Taiga v6.8.1 allows attack…6.1
• CVE-2024-5356A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-53561A remote code execution (RCE) vulnerability in Arcadyan Mete…8.7
• CVE-2024-53563A stored cross-site scripting (XSS) vulnerability in Arcadya…5.4
• CVE-2024-53566An issue in the action_listcategories() function of Sangoma …5.5
• CVE-2024-53568A stored cross-site scripting (XSS) vulnerability in the Ima…5.4
• CVE-2024-53569A stored cross-site scripting (XSS) vulnerability in the New…5.4
• CVE-2024-5357A vulnerability has been found in PHPGurukul Zoo Management …9.8
• CVE-2024-53573Unifiedtransform v2.X is vulnerable to Incorrect Access Cont…9.8
• CVE-2024-5358A vulnerability was found in PHPGurukul Zoo Management Syste…9.8