CVE-2021-47783

5.3 mediumEPSS 0.3%

Medium (5.3) in phpwcms phpwcms. EPSS 0.3% chance of exploitation in the next 30 days.

Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2026-01-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpwcms:phpwcms

References

http://www.phpwcms.org/
https://www.exploit-db.com/exploits/50363
https://www.vulncheck.com/advisories/phpwcms-arbitrary-file-upload
https://www.exploit-db.com/exploits/50363

Check your stack JSON