← Vulnerability feed

Vulnerability record · CVE-2013-4949 · published 29 July 2013

CVE-2013-4949: Machform vulnerability

Machform · Machform

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.

6.8 CVSS 2.0 Medium EPSS 5.5% · top 7.5%
6.8CVSS 2.0 base score
5.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/94802
http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html
http://www.exploit-db.com/exploits/26553 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/85386
http://osvdb.org/94802
http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html
http://www.exploit-db.com/exploits/26553 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/85386

Track CVE-2013-4949 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-37762Machform unrestricted file upload vulnerabilityMachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.EPSS 1.5%9.8CVE-2018-6410Machform sql injection vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.EPSS 4.9%9.8CVE-2018-6411Machform unrestricted file upload vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to …EPSS 5.8%8.8CVE-2024-37765Machform sql injection vulnerabilityMachform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.EPSS 0.83%8.8CVE-2021-20102Machform cross-site request forgery vulnerabilityMachform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.EPSS 0.51%8.1CVE-2021-20104Machform unrestricted file upload vulnerabilityMachform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded wit…EPSS 2.2%7.5CVE-2013-4948Machform sql injection vulnerabilitySQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.EPSS 3.5%6.1CVE-2021-20101Machform injection vulnerabilityMachform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to recei…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2013-4949), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.