CVE-2018-25162CWE-434

2-Plan Team 1.0.4 Arbitrary File Upload via managefile.php

High · published March 6, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

2-Plan Team 1.0.4 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload executable PHP files by sending multipart form data to managefile.php. Attackers can upload PHP files through the userfile1 parameter with action=upload, which are stored in the files directory and executed by the web server for remote code execution.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-06T12:18Z
EPSS history
Timeline
  • 06 MAR 12:18Z
    2-Plan Team 1.0.4 Arbitrary File Upload via managefile.php
    cvelistv5