CVE-2021-47783mediumCWE-434

Phpwcms 1.9.30 - Arbitrary File Upload

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%

probabilidad de explotación

0.3%top 74% de las CVE

explotación observada

noninguna fuente lo reporta

Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Phpwcms · Phpwcms

Referencias

https://www.exploit-db.com/exploits/50363 https://www.vulncheck.com/advisories/phpwcms-arbitrary-file-upload http://www.phpwcms.org/