← Vulnerability feed

Vulnerability record · CVE-2021-20104 · published 29 June 2021

CVE-2021-20104: Machform unrestricted file upload vulnerability

Machform · Machform

Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.

8.1 CVSS 3.1 High EPSS 2.2% · top 18.5% CWE-434 · Unrestricted file upload
8.1CVSS 3.1 base score, v2 6.8
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/

Track CVE-2021-20104 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-37762Machform unrestricted file upload vulnerabilityMachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.EPSS 1.5%9.8CVE-2018-6410Machform sql injection vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.EPSS 4.9%9.8CVE-2018-6411Machform unrestricted file upload vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to …EPSS 5.8%8.8CVE-2024-37765Machform sql injection vulnerabilityMachform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.EPSS 0.83%8.8CVE-2021-20102Machform cross-site request forgery vulnerabilityMachform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.EPSS 0.51%7.5CVE-2013-4948Machform sql injection vulnerabilitySQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.EPSS 3.5%6.8CVE-2013-4949Machform vulnerabilityUnrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then …EPSS 5.5%6.1CVE-2021-20101Machform injection vulnerabilityMachform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to recei…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2021-20104), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.