CVE-2024-9981: Formosasoft EE-Class

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server.

Affected products

• Formosasoft EE-Class: before 2024-03-26 (fixed in 2024-03-26)

Published 2024-10-15. Last modified 2026-06-17.