CVE Catalog
CVE-2021-42675
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk2.24%
81th percentile - higher than 81% of all known CVEs
Summary
Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. This allows uploading a malicious PHP file and achieving remote code execution.
Risk Assessment
An attacker can gain full control over the server, steal data, or install malware.
Recommendation
Immediately update Kreado Kreasfero to the latest version and implement file type validation and script execution restrictions in the media directory.
Original NVD description (English source)
Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.