KEVIntel
Back to KEVs
9.8
CVSS
Critical

CVE-2024-42640

PUBLISHED

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability...

PoC available Remote Low complexity No user interaction
Vendor
n/a
Product
n/a
Published
Oct 11, 2024
EPSS
—

Description

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

nuclei_scanner

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Proof of concept available

Recorded 2024-11-19 23:54:30 UTC · Source

SSVC decision points

Exploitation
poc
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
The Shadowserver (via CIRCL) Jun 26, 2025

Scanner integrations

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42640.yaml Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

KTN1990/CVE-2024-42640

github · Created 2024-11-19 23:54:30 UTC · 3 stars

Unauthenticated Remote Code Execution via Angular-Base64-Upload Library (npm:bower)

rvizx/CVE-2024-42640

github · Created 2024-10-09 14:35:06 UTC · 25 stars

Unauthenticated Remote Code Execution via Angular-Base64-Upload Library

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Detected by Nuclei

  • Added to KEVIntel