CVE-2015-7904 EXPLOIT
6.5
MEDIUM · CVSS 2.0 · EPSS 2.8% (pctl 86)
Patch early
A public exploit exists.
Description
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
Scoring
| CVSS | 6.5 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| EPSS | 2.78% — more likely to be exploited than 86% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2015-10-28 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| infinite automation systems | mango automation |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Mango Automation 2.6.0 - Multiple Vulnerabilities | 2015-09-28 |
References
→ the Explorer · watch your stack · NVD