CVE-2022-24651: Sentcms

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload.

Affected products

• Sentcms Sentcms: version 4.0.0 only

Published 2022-03-10. Last modified 2026-06-17.