GHSA-vhgr-gfx3-fg37HighCVSS 8.8

Unrestricted Upload of File with Dangerous Type in WPanel 4

Published
April 1, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-34257 →

📋 Description

Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.

🎯 Affected products1

  • composer/wpanel/wpanel4-cms:<= 4.3.1

🔗 References (4)