CVE-2021-42675: Kreado Kreasfero

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.

Affected products

• Kreado Kreasfero: version 1.5 only

Published 2022-06-14. Last modified 2026-07-09.