Master Mind

**Name of the Vulnerable Software and Affected Versions** Element-IT Ultimate Uploader version 1.3 **Description** The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the upload/ directory, and then accessing it via a direct request. This is due to an unrestricted file upload vulnerability. **Recommendations** For Element-IT Ultimate Uploader version 1.3, consider restricting file uploads to only allow non-executable file extensions as a temporary workaround until a patch is available. Restrict access to the upload/ directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHPSimplicity Simplicity oF Upload version 1.3.2 **Description** The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension. This can be achieved by uploading a file such as `.php.gif` to the `upload.php` endpoint. **Recommendations** For version 1.3.2, consider restricting or validating file uploads in the `upload.php` script to prevent uploading files with double extensions, and ensure that only authorized users can upload files.