CVE-2024-57968

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to...

9.9 CriticalIn KEV

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

32.3%Up 32.2 points since Feb 4, 2025

What each source reports

CVE List Score used 9.9

Record: CVE-2024-57968
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

EUVDEUVD-2024-53868 9.9

Record: EUVD-2024-53868
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gx78-3r6j-qx7f 9.9

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to...

Record: GHSA-gx78-3r6j-qx7f
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

CISA KEV No score

Advantive VeraCore Unrestricted File Upload Vulnerability

Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.

Record: CVE-2024-57968
Weakness: CWE-434
Updated: 2026-11-02

NVD 9.9

Record: CVE-2024-57968
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

Affected products

advantive veracore

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-57968 is a critical vulnerability (CVSS 9.9) in Advantive Veracore, published February 3, 2025. CISA lists it as known to be exploited, since March 10, 2025. EUVD reports exploitation since March 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.3%, the 98th percentile. No source names a fixed version.