What’s Vulnerable › Vulnerabilities

CVE-2019-15130

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-08-18 · updated 2026-06-17
• Weakness: CWE-330

Description

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parameter. Moreover, the attacker can upload executable content (e.g., asp or aspx) for executing OS commands on the server.

Affected products

• Humanica Humatrix 7: 1.0.0.203, 1.0.0.681

References

• https://gist.github.com/izadgot/38a7dd553f8024ed3154134dae0414fd
• https://gist.github.com/izadgot/38a7dd553f8024ed3154134dae0414fd

Get alerted when CVE-2019-15130 or the next vulnerability affects your stack