CVE-2014-9619

7.2 highEPSS 7.4%

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.

Severity

CVSS 3.0

7.2 high

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2017-09-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

netsweeper:netsweeper

References

http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
https://www.exploit-db.com/exploits/37932/
http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
https://www.exploit-db.com/exploits/37932/

Check your stack JSON