CVE-2015-9263

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5254.phpExploit, Third Party Advisory
https://www.exploit-db.com/exploits/37888/Exploit, Third Party Advisory, VDB Entry
https://www.rapid7.com/db/modules/exploit/multi/http/uptime_file_upload_2Third Party Advisory
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5254.phpExploit, Third Party Advisory
https://www.exploit-db.com/exploits/37888/Exploit, Third Party Advisory, VDB Entry
https://www.rapid7.com/db/modules/exploit/multi/http/uptime_file_upload_2Third Party Advisory

Timeline

Published: Aug 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92649.8Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windo CVE-2015-92669.8The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated att CVE-2015-92675.5Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files CVE-2015-92687.8Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protectio CVE-2015-92697.5The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke CVE-2015-92706.1XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.CVE-2015-92719.8The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code bec CVE-2015-92729.8The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php CVE-2015-92736.1The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated w CVE-2015-92746.5HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS CVE-2015-92755.3ARC 5.21q allows directory traversal via a full pathname in an archive file.CVE-2015-92766.1SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScri