What is CVE-2013-10066?

CVE-2013-10066 is a vulnerability in Kordil Edms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-05.

Is CVE-2013-10066 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Arbitrary file upload in Kordil Edms

CVE-2013-10066

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authenticatio…

Vulnerability class: Unrestricted File Upload

EPSS: 0.824 (99.2th percentile) — read the EPSS interpretation.

Affected products

Kordil Edms — versions 2.2.60rc3

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

Public proof-of-concept exploits

rapid7/metasploit-framework

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/m… (exploit)
www.exploit-db.com/exploits/24547 (exploit)
www.juniper.net/us/en/threatlabs/ips-signatures/detail.APP:MSF-KORDIL-EDMS-AFU… (third-party-advisory)
sourceforge.net/projects/kordiledms/ (product)
www.vulncheck.com/advisories/kordil-edms-unauth-arbitrary-file-upload (third-party-advisory)

Frequently asked questions

What is CVE-2013-10066?: CVE-2013-10066 is a vulnerability in Kordil Edms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-05.
Is CVE-2013-10066 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.