CVE-2023-27397

9.8 criticalEPSS 0.9%

Critical (9.8) in microengine mailform. EPSS 0.9% chance of exploitation in the next 30 days.

Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2023-05-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microengine:mailform

References

https://jvn.jp/en/jp/JVN31701509/
https://microengine.jp/information/security_2023_05.html
https://jvn.jp/en/jp/JVN31701509/
https://microengine.jp/information/security_2023_05.html

Check your stack JSON