CVE-2022-43074: Ayacms Project Ayacms

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Affected products

• Ayacms Project Ayacms: version 3.1.2 only

Published 2022-11-10. Last modified 2026-06-17.