Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed image/jpeg Content-Type to bypass the absence of extension and MIME type validation, with the uploaded file stored at a predictable path under the uploadfile directory and executed directly by the web server. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-03 (UTC).
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-02 | 2 | Disclosure2 |
| 2026-07-03 | 1 | Active Exploitation1 |
| 2026-07-13 | 1 | Disclosure1 |
CVE-2024-14037 Remote Code Execution via Arbitrary File Upload in Redsea Cloud eHR https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-14037
Post summary
The tweet announces CVE-2024-14037, highlighting a remote code execution flaw in Redsea Cloud eHR that allows arbitrary file uploads, and provides a link for further details.
🚨Critical - Red Sea Cloud eHR Unauthenticated File Upload RCE (CVE-2024-14037) Red Sea Cloud eHR's PtFjk.mob servlet accepts multipart uploads with no extension or MIME type validation. An unauthenticated attacker can submit a JSP webshell disguised with a spoofed image/jpeg Content-Type; the file is stored at a predictable path under the uploadfile directory and executed directly by the web server. The result is unauthenticated remote code execution. CISA rates it as automatable with a public PoC, and exploitation has been observed in the wild by Shadowserver since November 2024. 👉Affected: all Red Sea Cloud eHR versions - apply vendor guidance / restrict access to the PtFjk.Mob endpoint.
Post summary
CVE‑2024‑14037 enables unauthenticated RCE via a file‑upload flaw in Red Sea Cloud eHR, with a public PoC and confirmed wild exploitation observed by Shadowserver; vendors advise restricting the affected endpoint.
🚨*CVE* CVE-2024-14037 Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files t… https://www.cve.org/CVERecord?id=CVE-2024-14037 ----- Traducción: CVE-2024-14037 Red… http://infoflow.cloud`
Post summary
The tweet announces CVE-2024-14037, noting an arbitrary file upload flaw in Redsea Cloud eHR that can lead to unauthenticated remote code execution, without providing PoC, exploit code, or patch details.
CVE-2024-14037 Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files t… https://www.cve.org/CVERecord?id=CVE-2024-14037
Post summary
The post announces CVE-2024-14037, detailing an arbitrary file upload flaw that can lead to remote code execution, but offers no PoC, exploit code, or patch information.