What is CVE-2013-10066?

CVE-2013-10066 is a vulnerability in Kordil Edms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-05.

Is CVE-2013-10066 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Arbitrary file upload in Kordil Edms

CVE-2013-10066

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.

Vulnerability class: Unrestricted File Upload

EPSS: 0.012 (63.8th percentile) — read the EPSS interpretation.

Affected products

Kordil Edms — versions 2.2.60rc3

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

Public proof-of-concept exploits

rapid7/metasploit-framework

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2013-10066?: CVE-2013-10066 is a vulnerability in Kordil Edms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-05.
Is CVE-2013-10066 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.