CVE-2022-30007

HIGH

GXCMS V1.5 - Unauthenticated Arbitrary File Upload via Template Management

Title source: llm
STIX 2.1

Description

GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0091
EPSS Percentile 55.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-434
Status published
Products (1)
gxcms_project/gxcms 1.5
Published May 17, 2022
Tracked Since Feb 18, 2026