How severe is CVE-2013-4949?

CVE-2013-4949 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2013-4949 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-4949?

CVE-2013-4949 affects Machform. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2013-4949?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2013-4949 published?

CVE-2013-4949 was published on 2013-07-29 and last updated on 2026-06-16.

CVE-2013-4949

CVE-2013-4949 is a medium-severity vulnerability in Machform with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 6.8)
EPSS exploit prediction: 5% (92nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Machform
Published: 2013-07-29
Last modified: 2026-06-16

Description

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.

Frequently asked questions

What is CVE-2013-4949?: Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.
How severe is CVE-2013-4949?: CVE-2013-4949 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2013-4949 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2013-4949?: CVE-2013-4949 affects Machform. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2013-4949?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2013-4949 published?: CVE-2013-4949 was published on 2013-07-29 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:machform:machform:2.0:*:*:*:*:*:*:*

More vulnerabilities in Machform

CVE-2024-37762 — Critical (CVSS 9.9): MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code…
CVE-2018-6411 — Critical (CVSS 9.8): An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically…
CVE-2018-6410 — Critical (CVSS 9.8): An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.
CVE-2024-37765 — High (CVSS 8.8): Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
CVE-2021-20102 — High (CVSS 8.8): Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.
CVE-2021-20104 — High (CVSS 8.1): Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of…

All CVEs affecting Machform →