CVE-2022-40341

HighCVSS 8.8

Published: 30/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.06%

61th percentile - higher than 61% of all known CVEs

Summary

mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability that allows attackers to execute arbitrary code via a crafted PNG file.

Risk Assessment

An attacker can gain remote control over the server, steal data, or install malware, leading to full system compromise.

Recommendation

Immediately update mojoPortal to the latest version and implement file type validation and upload directory permission restrictions.

Other vulnerabilities in mojoPortal

CVE-2022-40123Medium
mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the 'f' parameter at /DesignTools/CssEditor.aspx. This allows authenticated attackers to read arbitrary files on the system.

Original NVD description (English source)

mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS