CVE-2023-50692

HIGH

Jizhicms - Unrestricted File Upload

Title source: rule

Description

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.

References (1)

[Exploit, Issue Tracking] https://github.com/Cherry-toto/jizhicms/issues/91

Scores

CVSS v3 8.8

EPSS 0.0184

EPSS Percentile 83.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

jizhicms/jizhicms 2.5

Published Dec 28, 2023

Tracked Since Feb 18, 2026