Threats tagged 'ghsa-rp7m-4f5j-m5wj'

The Mozart FM Transmitter web management interface version WEBMOZZI-00287 has an unauthenticated file upload vulnerability in the /upload_file.php endpoint. This flaw allows an attacker to upload malicious files, such as a PHP webshell, without authentication. The uploaded files are stored in the /upload/ directory, enabling remote code execution and full system compromise. The vulnerability has a critical CVSS score of 9.8.