CVE-2024-7342

A vulnerability was found in Baidu UEditor 1.4.3.3. It has been classified as problematic. This affects an unknown part of the file /ueditor/php/controller.php?action=uploadfile&encode=utf-8. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273273 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-434

• https://github.com/Hebing123/cve/issues/62Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.273273Permissions Required, Third Party Advisory
• https://vuldb.com/?id.273273Permissions Required, Third Party Advisory
• https://vuldb.com/?submit.380092Third Party Advisory

Published

Aug 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7336A vulnerability classified as critical was found in TOTOLINK…8.8
• CVE-2024-7337A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-7338A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-7339A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR …5.3
• CVE-2024-7340The Weave server API allows remote users to fetch files from…8.8
• CVE-2024-7341A session fixation issue was discovered in the SAML adapters…7.1
• CVE-2024-7343A vulnerability was found in Baidu UEditor 1.4.2. It has bee…6.1
• CVE-2024-7344Howyar UEFI Application "Reloader" (32-bit and 64-bit) is …8.2
• CVE-2024-7345Local ABL Client bypass of the required PASOE security check…9.6
• CVE-2024-7346Host name validation for TLS certificates is bypassed when t…4.8
• CVE-2024-7347NGINX Open Source and NGINX Plus have a vulnerability in the…4.7
• CVE-2024-7348Time-of-check Time-of-use (TOCTOU) race condition in pg_dump…7.5