CVE-2013-10067
NONE—CVSS v3
—CVSS v2
52.99%
EPSS (exploit probability)
CWE-434CWE
Description
Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.
Affected routers (0)
No routers currently mapped to this CVE in our database.