CVE-2019-7216

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user to upload any type of file by using % characters within the extension, e.g., file.%ph%p becomes file.php.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jan 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72177.5Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses CVE-2019-72185.9Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the CVE-2019-72196.1Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. CVE-2019-72206.1X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.CVE-2019-72217.8The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.CVE-2019-72225.5The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.CVE-2019-72235.4InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create CVE-2019-72258.8The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These cred CVE-2019-72268.8The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to pr CVE-2019-72277.3In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the CVE-2019-72288.8The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate wit CVE-2019-72298.3The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card t