CVE-2017-13670

PoC —

CVSS 3.0

6.5 medium

EPSS

<1%p56

Published

Aug 31, 2017 (Aug 31, 2017)

Modified

Jun 17, 2026

Description

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demonstrated by a ZIP archive that contains a .php file.

Vendors: blackcat-cms
Products: blackcat cms
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.