CVE-2013-0803

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.exploit-db.com/exploits/24549Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/82378Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/cve/CVE-2013-0803Exploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/24549Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/82378Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/cve/CVE-2013-0803Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 11, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-080410.0The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a den CVE-2013-08054.3Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier al CVE-2013-08074.3Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier a CVE-2013-080910.0Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 U CVE-2013-08108.1Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute CVE-2013-08119.3Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site CVE-2013-08286.8The PDF functionality in Google Chrome before 24.0.1312.52 does not properly perform a cast of an unspecified variable during processing of CVE-2013-08296.4Google Chrome before 24.0.1312.52 does not properly maintain database metadata, which allows remote attackers to bypass intended file-access CVE-2013-08307.5The IPC layer in Google Chrome before 24.0.1312.52 on Windows omits a NUL character required for termination of an unspecified data structur CVE-2013-08317.5Directory traversal vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to have an unspecified impact by leveraging a CVE-2013-08327.5Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unsp CVE-2013-08335.0Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to printing.