This vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), affects the Import XML and RSS Feeds product by Moove Agency through version 2.1.5. It allows an attacker with high privileges to upload files of dangerous types without restriction, potentially enabling remote code execution or other severe impacts. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could result in complete compromise of the affected system's confidentiality, integrity, and availability due to the ability to upload and potentially execute malicious files. This could lead to unauthorized access, data manipulation, or denial of service. No known active exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Import XML and RSS Feeds functionality to trusted users only, and monitor for any suspicious file uploads. Avoid exposing this functionality to untrusted or low-privilege users.