CVE-2015-2994: SysAid

Medium severity, CVSS 6.5. EPSS: 49.8% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.

Affected products

• SysAid SysAid: up to and including 15.1

Published 2015-06-08. Last modified 2026-06-17.