CVE-2023-53950

InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulation

CVSS 9.3 CRITICALEPSS 0.6%CWE-434

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.3EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

19 dic 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictions through filename manipulation. Attackers can upload malicious ASP shells by using null byte techniques and alternate file extensions to circumvent upload controls in the asset manager.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

innovastudio · WYSIWYG Editor

Referencias

https://innovastudio.com https://www.exploit-db.com/exploits/51362 https://www.vulncheck.com/advisories/innovastudio-wysiwyg-editor-unrestricted-file-upload-via-filename-manipulation