PHP CVE-2022-50893

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-01-13 disclosure@vulncheck.com

PHP RCE Wallpaper Admin Viaviweb

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 22, 2026 - 20:13 vuln.today

Public exploit code

CVE Published

Jan 13, 2026 - 23:15 nvd

CRITICAL 9.8

DescriptionCVE.org

VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a malicious PHP file through the add_gallery_image.php endpoint to execute arbitrary code on the server.

AnalysisAI

VIAVIWEB Wallpaper Admin 1.0 allows unauthenticated PHP file upload through the add_gallery_image.php endpoint. PoC available.

Technical ContextAI

The image upload does not validate file types (CWE-434) and requires no authentication.

RemediationAI

Do not use this application in production.

More in PHP

View all

CVE-2019-11043 CRITICAL Emergency POC

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL Act Now POC

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2018-11138 CRITICAL Emergency POC

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

CVE-2024-11680 CRITICAL Act Now POC

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2024-50623 CRITICAL POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2018-9206 CRITICAL POC

CVE-2024-5084 CRITICAL POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2022-50893 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy