CVE-2018-14441

CRITICAL

cckevincyh SSH CompanyWebsite <2018-05-03 - File Upload

Title source: llm

Description

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadAction_fileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://github.com/cckevincyh/CompanyWebsite/issues/4

Scores

CVSS v3 9.8

EPSS 0.0041

EPSS Percentile 61.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

ssh_companywebsite_project/ssh_companywebsite < 2018-05-03

Published Jul 20, 2018

Tracked Since Feb 18, 2026