CVE-2019-15751: Sitos Six

Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days.

An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to the web root of the application.

Affected products

• Sitos Sitos Six: version 6.2.1 only

Published 2019-10-07. Last modified 2026-06-17.