CVE-2021-40188

PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the server.

• CWE-434

• https://github.com/PHPFusion/PHPFusion/issues/2372Exploit, Issue Tracking, Third Party Advisory
• https://github.com/PHPFusion/PHPFusion/issues/2372Exploit, Issue Tracking, Third Party Advisory

Published

Oct 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40176Zoho ManageEngine Log360 before Build 5225 allows stored XSS…6.1
• CVE-2021-40177Zoho ManageEngine Log360 before Build 5225 allows remote cod…9.8
• CVE-2021-40178Zoho ManageEngine Log360 before Build 5224 allows stored XSS…6.1
• CVE-2021-4018snipe-it is vulnerable to Improper Neutralization of Input D…5.4
• CVE-2021-40180In the WeChat application 8.0.10 for Android and iOS, a mini…7.5
• CVE-2021-40186The AppCheck research team identified a Server-Side Request …7.5
• CVE-2021-40189PHPFusion 9.03.110 is affected by a remote code execution vu…7.2
• CVE-2021-4019vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-40191Dzzoffice Version 2.02.1 is affected by cross-site scripting…5.4
• CVE-2021-4020janus-gateway is vulnerable to Improper Neutralization of In…5.4
• CVE-2021-4021A vulnerability was found in Radare2 in versions prior to 5.…7.5
• CVE-2021-40211An issue was discovered with ImageMagick 7.1.0-4 via Divisio…7.5