CVE-2026-4220

HIGH

Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload

Title source: cna

Description

A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebpagePic.jsp. The manipulation of the argument targetPath/Suffix leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-351144 | Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload

https://vuldb.com/?id.351144

Signature, Permissions Required signature permissions-required

VDB-351144 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/?ctiid.351144

Third Party Advisory third-party-advisory

Submit #770523 | Tiandy Technologies Co., Ltd. Integrated Management Platform 7.17.0 Unrestricted Upload of File with Dangerous Type

https://vuldb.com/?submit.770523

Exploit exploit

https://my.feishu.cn/docx/EA9HdaXaQo80yTxKdw0c3UDmnmD?from=from_copylink

Scores

CVSS v3 7.3

EPSS 0.0031

EPSS Percentile 22.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-284 CWE-434

Status published

Products (1)

Technologies/Integrated Management Platform 7.17.0

Published Mar 16, 2026

Tracked Since Mar 16, 2026