CVE-2019-16113
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code…
published September 8, 2019
Patch now
High probability of exploitation
NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.
What it is
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.77962 · 99.6th percentile
- Published
- 2019-09-08T20:50Z
EPSS history
Timeline