{"id":"CVE-2024-57337","aliases":["EUVD-2025-16195","GHSA-wxg6-4cwm-4rjf"],"status":"published","title":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026...","description":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026 ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute arbitrary code via supplying a crafted file.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00329,"percentile":0.26336,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2025-05-28T00:00:00Z","modified":"2026-06-17T08:13:30Z","references":[{"url":"https://www.m2soft.co.kr/sub/board/news.asp?mode=view\u0026idx=2411"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57337"},{"url":"https://github.com/advisories/GHSA-wxg6-4cwm-4rjf"}],"sources":{"cve":[{"id":"CVE-2024-57337","description":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026 ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute arbitrary code via supplying a crafted file.","status":"published","published":"2025-05-28T00:00:00Z","modified":"2025-05-30T20:32:00.767Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2025-16195","description":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026 ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute arbitrary code via supplying a crafted file.","status":"published","published":"2025-05-28T00:00:00Z","modified":"2025-05-30T20:32:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:33.750801Z"}],"ghsa":[{"id":"GHSA-wxg6-4cwm-4rjf","title":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026...","description":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026 ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute arbitrary code via supplying a crafted file.","status":"published","published":"2025-05-28T18:33:29Z","modified":"2025-05-30T21:30:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:02:31.34634Z"}],"nvd":[{"id":"CVE-2024-57337","description":"An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report \u0026 ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute arbitrary code via supplying a crafted file.","status":"published","published":"2025-05-28T18:15:25.313Z","modified":"2026-06-17T08:13:30.287Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}