{"id":"CVE-2021-34257","aliases":["GHSA-vhgr-gfx3-fg37"],"url":"https://o3.security/vulnerability/CVE-2021-34257","summary":"Unrestricted Upload of File with Dangerous Type in WPanel 4","details":"Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.","published":"2022-03-31T16:15:07.513Z","modified":"2026-07-09T00:36:42.494319Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Packagist","name":"wpanel/wpanel4-cms","fixedVersion":null}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://github.com/Sentinal920/WPanel4-Authenticated-RCE"},{"type":"EVIDENCE","url":"https://latestpcsolution.wordpress.com/2021/06/05/wpanel4-cms-authenticated-rce/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T00:36:42.494319Z"}}