CVE-2013-10066 — Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload
An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to uplo…
Published: 2025-08-05 · CVSS: 10.0 · CVSS 4.0
An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7