CVE-2026-110025
Received
Received - Intake
Unrestricted File Upload in phpwcms
Vulnerability report for CVE-2026-110025, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: VulDB
Description
Description
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| slackero | phpwcms | 1.9.0 |
| slackero | phpwcms | 1.9.1 |
| slackero | phpwcms | 1.9.2 |
| slackero | phpwcms | 1.9.3 |
| slackero | phpwcms | 1.9.4 |
| slackero | phpwcms | 1.9.5 |
| slackero | phpwcms | 1.9.6 |
| slackero | phpwcms | 1.9.7 |
| slackero | phpwcms | 1.9.8 |
| slackero | phpwcms | 1.9.9 |
| slackero | phpwcms | 1.9.10 |
| slackero | phpwcms | 1.9.11 |
| slackero | phpwcms | 1.9.12 |
| slackero | phpwcms | 1.9.13 |
| slackero | phpwcms | 1.9.14 |
| slackero | phpwcms | 1.9.15 |
| slackero | phpwcms | 1.9.16 |
| slackero | phpwcms | 1.9.17 |
| slackero | phpwcms | 1.9.18 |
| slackero | phpwcms | 1.9.19 |
| slackero | phpwcms | 1.9.20 |
| slackero | phpwcms | 1.9.21 |
| slackero | phpwcms | 1.9.22 |
| slackero | phpwcms | 1.9.23 |
| slackero | phpwcms | 1.9.24 |
| slackero | phpwcms | 1.9.25 |
| slackero | phpwcms | 1.9.26 |
| slackero | phpwcms | 1.9.27 |
| slackero | phpwcms | 1.9.28 |
| slackero | phpwcms | 1.9.29 |
| slackero | phpwcms | 1.9.30 |
| slackero | phpwcms | 1.9.31 |
| slackero | phpwcms | 1.9.32 |
| slackero | phpwcms | 1.9.33 |
| slackero | phpwcms | 1.9.34 |
| slackero | phpwcms | 1.9.35 |
| slackero | phpwcms | 1.9.36 |
| slackero | phpwcms | 1.9.37 |
| slackero | phpwcms | 1.9.38 |
| slackero | phpwcms | 1.9.39 |
| slackero | phpwcms | 1.9.40 |
| slackero | phpwcms | 1.9.41 |
| slackero | phpwcms | 1.9.42 |
| slackero | phpwcms | 1.9.43 |
| slackero | phpwcms | 1.9.44 |
| slackero | phpwcms | 1.9.45 |
| slackero | phpwcms | 1.9.46 |
| slackero | phpwcms | 1.9.47 |
| slackero | phpwcms | 1.9.48 |
| slackero | phpwcms | 1.9.49 |
| slackero | phpwcms | 1.12.0 |
| slackero | phpwcms | 1.12.1 |
| slackero | phpwcms | 1.12.2 |
| slackero | phpwcms | 1.12.3 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
