Common Weakness Enumeration
CWE-616 Incomplete Identification of Uploaded File Variables (PHP)
Description
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-616 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-cgr4-c233-h733 | CVE-2024-52305 | MODERATE | - |
UnoPim Stored XSS : Cookie hijacking through Create User function |
2024-11-13 |