CVE-2008-5677

no score yetEPSS 4.1%

kwalbum kwalbum: no CVSS score yet. EPSS 4.1% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.

EPSS: 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2008-12-19
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

kwalbum:kwalbum

References

http://secunia.com/advisories/32145
http://securityreason.com/securityalert/4789
http://www.securityfocus.com/bid/31568
https://exchange.xforce.ibmcloud.com/vulnerabilities/45655
https://www.exploit-db.com/exploits/6664

Check your stack JSON