CVE-2021-47783

low-risk
Published 2026-01-16

Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Phpwcms

Affected Vendors

Phpwcms

References (4)

Product http://www.phpwcms.org/
Exploit https://www.exploit-db.com/exploits/50363
Third Party Advisory https://www.vulncheck.com/advisories/phpwcms-arbitrary-file-upload
Exploit https://www.exploit-db.com/exploits/50363
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal