Back to overview

CVE-2026-16324

HIGH
7.3
CVSS 3.1
Description
A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metadata

CVE ID
CVE-2026-16324
State
PUBLISHED
Assigner
VulDB
Reserved
2026-07-20 17:42 UTC
Published
2026-07-20 21:45 UTC
Last updated
2026-07-20 21:45 UTC
Primary CWE
CWE-434
Unrestricted Upload
Vendor / Product
Metasoft 美特软件 / MetaCRM
Sources
cve.org  ·  NVD

Severity & Metrics

7.3 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Affected products (1)
VendorProductPlatformVersions
Metasoft 美特软件 MetaCRM — 6.4.0 Beta06
Weakness (CWE)
CWESourceDescription
CWE-284 cna Improper Access Controls
CWE-434 cna Unrestricted Upload
CVSS scores (4)
ScoreSeverityVersionSourceVector
7.5 N/D 2.0 cna AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
7.3 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
7.3 HIGH 3.0 cna CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.9 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
References (5)
Back to overview