CVE-2024-48694: Xian Daxi Information Technology Officeweb 365

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component.

Affected products

• Xian Daxi Information Technology Officeweb 365: version 7.18.23.0 only; version 8.6.1.0 only

Published 2024-11-19. Last modified 2026-06-17.