What’s Vulnerable › Vulnerabilities

CVE-2021-47783: Phpwcms 1.9.30 - Arbitrary File Upload

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-16 · updated 2026-06-17
• Weakness: CWE-434

Description

Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

Affected products

• slackero phpwcms: 1.9.30

References

• http://www.phpwcms.org/
• https://www.exploit-db.com/exploits/50363
• https://www.vulncheck.com/advisories/phpwcms-arbitrary-file-upload
• https://www.exploit-db.com/exploits/50363

Get alerted when CVE-2021-47783 or the next vulnerability affects your stack