CVE-2005-1604: Bugada Andrea PHP Advanced Transfer Manager

High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days.

PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as demonstrated using a filename ending in "php.ns", which allows execution of arbitrary PHP code.

Affected products

• Bugada Andrea PHP Advanced Transfer Manager: version 1.21 only

Published 2005-05-16. Last modified 2026-06-16.