CVE-2019-20183

uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side

published January 9, 2020

CVSS
—
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07770 · 94.6th percentile
Published
2020-01-09T21:21Z
EPSS history
Timeline
  • 09 JAN 21:21Z
    uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side
    cvelistv5