Skip to main content

Bit Form CVE-2024-43249

HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2024-08-19 audit@patchstack.com
Command Injection File Upload Bit Form Bitapps
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 19, 2024 - 18:15 nvd
HIGH 8.8

DescriptionNVD

Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a through 2.6.4.

AnalysisAI

Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.6.4. Affected products include: Bitapps Bit Form. Version information: through 2.6.4..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Bit Form

View all
CVE-2026-16573 HIGH POC
7.5 Aug 05

Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload cr
CVE-2026-13694 MEDIUM POC
6.5 Jul 21

Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re
CVE-2026-13693 MEDIUM POC
5.9 Jul 21

Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read

CVE-2024-43248 CRITICAL
9.1 Aug 19

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro al
CVE-2025-15669 MEDIUM POC
4.8 Aug 01

Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to
CVE-2026-15054 LOW POC
3.7 Jul 30

Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handler
CVE-2024-43251 MEDIUM
6.5 Aug 26

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.6.4. Rated medium seve
CVE-2024-43250 MEDIUM
6.5 Aug 19

Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Co
CVE-2024-13451 MEDIUM
5.3 Jul 02

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form buil

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2024-43249 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy