What’s Vulnerable › Vulnerabilities

CVE-2019-25480: ARMBot Unrestricted File Upload via upload.php

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-06-17
• Weakness: CWE-22

Description

ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to upload arbitrary files by manipulating the file parameter with path traversal sequences. Attackers can upload PHP files with traversal payloads ../public_html/ to write executable code to the web root and achieve remote code execution.

Affected products

• ARMBot: all versions

References

• https://www.exploit-db.com/exploits/47209
• https://www.vulncheck.com/advisories/armbot-unrestricted-file-upload-via-upload-php

Get alerted when CVE-2019-25480 or the next vulnerability affects your stack