CVE-2013-4949: Machform

Medium severity, CVSS 6.8. EPSS: 5.5% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.

Affected products

• Machform Machform: version 2.0 only

Published 2013-07-29. Last modified 2026-06-16.