CVE-2022-46610

8.8 highEPSS 18%

High (8.8) in 72crm wukong crm. EPSS 18% chance of exploitation in the next 30 days.

72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2023-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

72crm:wukong_crm

References

https://github.com/72wukong/72crm-9.0-PHP/issues/36
https://github.com/72wukong/72crm-9.0-PHP/issues/36

Check your stack JSON