L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST (attachment, attachment_name, attachment_size and attachment_type), which allows remote attackers to read arbitrary files.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00503
Percentile: 0.65081

CVSS Scoring

Affected Products

• cpe:2.3:a:leszek_krupinski:l-forum:2.4.0:*:*:*:*:*:*:*

← Back to Home