How severe is CVE-2024-9280?

CVE-2024-9280 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2024-9280 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-9280?

CVE-2024-9280 affects Kvf-admin Project Kvf-admin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-9280?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-9280 have an EU (EUVD) identifier?

Yes. CVE-2024-9280 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49830.

When was CVE-2024-9280 published?

CVE-2024-9280 was published on 2024-09-27 and last updated on 2026-06-17.

CVE-2024-9280

CVE-2024-9280 is a medium-severity vulnerability in Kvf-admin Project Kvf-admin with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-434.

Key facts

Severity: Medium (CVSS 3.x base score 4.7)
CVSS v2: 5.8
CVSS v4: 5.1
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-49830
Weakness: CWE-434
Affected product: Kvf-admin Project Kvf-admin
Published: 2024-09-27
Last modified: 2026-06-17

Description

A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Frequently asked questions

What is CVE-2024-9280?: A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
How severe is CVE-2024-9280?: CVE-2024-9280 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2024-9280 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-9280?: CVE-2024-9280 affects Kvf-admin Project Kvf-admin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-9280?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-9280 have an EU (EUVD) identifier?: Yes. CVE-2024-9280 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49830.
When was CVE-2024-9280 published?: CVE-2024-9280 was published on 2024-09-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:kvf-admin_project:kvf-admin:2022-02-12:*:*:*:*:*:*:*

More vulnerabilities in Kvf-admin Project Kvf-admin

CVE-2022-35857 — Critical (CVSS 9.8): kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled.…
CVE-2024-9291 — Low (CVSS 3.5): A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to…

All CVEs affecting Kvf-admin Project Kvf-admin →

Other CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities

CVE-2026-48283 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
CVE-2026-48276 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
CVE-2026-57700 — Critical (CVSS 10.0): Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This…
CVE-2025-69129 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7…
CVE-2026-40772 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
CVE-2026-40412 — Critical (CVSS 10.0): Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code…

Browse all CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities →