CVE-2023-53950

InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulation

CVSS 9.3 CRITICALEPSS 0.6%CWE-434

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.3EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

19 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictions through filename manipulation. Attackers can upload malicious ASP shells by using null byte techniques and alternate file extensions to circumvent upload controls in the asset manager.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

innovastudio · WYSIWYG Editor

Referências

https://innovastudio.com https://www.exploit-db.com/exploits/51362 https://www.vulncheck.com/advisories/innovastudio-wysiwyg-editor-unrestricted-file-upload-via-filename-manipulation