https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-29434.htmlhttps://patchthecve.com/cve/CVE-2024-29434.htmlWed, 17 Jun 2026 07:22:49 +0000HIGH 8.3: An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.https://patchthecve.com/cve/CVE-2024-29432.htmlhttps://patchthecve.com/cve/CVE-2024-29432.htmlWed, 17 Jun 2026 07:22:49 +0000CRITICAL 9.8: Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.https://patchthecve.com/cve/CVE-2024-27605.htmlhttps://patchthecve.com/cve/CVE-2024-27605.htmlWed, 17 Jun 2026 07:20:04 +0000HIGH 7.5: Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.https://patchthecve.com/cve/CVE-2024-27604.htmlhttps://patchthecve.com/cve/CVE-2024-27604.htmlWed, 17 Jun 2026 07:20:04 +0000CRITICAL 9.8: Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.https://patchthecve.com/cve/CVE-2024-27602.htmlhttps://patchthecve.com/cve/CVE-2024-27602.htmlWed, 17 Jun 2026 07:20:04 +0000CRITICAL 9.1: Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.https://patchthecve.com/cve/CVE-2024-29435.htmlhttps://patchthecve.com/cve/CVE-2024-29435.htmlWed, 17 Jun 2026 07:22:49 +0000MEDIUM 4.1: An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.https://patchthecve.com/cve/CVE-2024-29433.htmlhttps://patchthecve.com/cve/CVE-2024-29433.htmlWed, 17 Jun 2026 07:22:49 +0000CRITICAL 9.8: A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.