CVE-2023-43838

7.8 highEPSS 0.6%

High (7.8) in personal-management-system personal management system. EPSS 0.6% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2023-10-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

personal-management-system:personal_management_system

References

http://www.w3.org/2000/svg
https://github.com/Volmarg
https://github.com/Volmarg/personal-management-system
https://github.com/Volmarg/personal-management-system/blob/39d3c0df641a5435f2028b37a27d26ba61a3b97b/src/assets/scripts/core/ui/DataProcessor/SpecialAction.ts#L35
https://github.com/rootd4ddy/

Check your stack JSON