CVE-2024-13984

🗓️ 27 Aug 2025 21:25:52Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Path traversal in TianQing Management Center up to 6.7.0.4130 enables unauthenticated uploads to arbitrary server paths via /rptsvr/upload, risking remote code execution.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-13984	29 Aug 202521:02	–	circl
CNNVD	QiAnXin TianQing Management Center 安全漏洞	27 Aug 202500:00	–	cnnvd
Cvelist	CVE-2024-13984 Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload	27 Aug 202521:25	–	cvelist
EUVD	EUVD-2024-54924	3 Oct 202520:07	–	euvd
NVD	CVE-2024-13984	27 Aug 202522:15	–	nvd
Positive Technologies	PT-2025-34941 · Qi Anxin · Qianxin Tianqing Management Center	27 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-13984	30 Aug 202518:16	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2024-13984	23 Aug 202400:00	–	vulncheck_kev
Vulnrichment	CVE-2024-13984 Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload	27 Aug 202521:25	–	vulnrichment

Vulners

Node

qi'anxin tianqing_management_centerRange0–6.7.0.4130

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "/rptsvr/upload"
    ],
    "product": "TianQing Management Center",
    "vendor": "Qi'anxin",
    "versions": [
      {
        "lessThanOrEqual": "6.7.0.4130",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/qianxin-tianqing-management-center-arbitrary-file-upload
cn-sec	www.cn-sec.com/archives/2421288.html
blog	www.blog.csdn.net/maxiluo/article/details/135865584
qianxin	www.qianxin.com/product/detail/pid/330

Parameter	Position	Path	Description	CWE
filename	request body	/rptsvr/upload	Path traversal in multipart form-data upload enables uploading files to arbitrary server locations via filename parameter, potentially leading to remote code execution.	CWE-22, CWE-73

17 Jun 2026 07:03Current

7.3High risk

Vulners AI Score7.3

CVSS 410

EPSS0.00758

SSVC

In Wild