CVE-2021-42675

CVE-2021-42675 describes a critical file upload vulnerability in Kreado Kreasfero 1.5. This flaw allows an unauthenticated attacker to upload malicious PHP files to the media directory, leading to unauthenticated remote code execution. With a CVSS score of 9.8, the vulnerability is easily exploitable over the network with no user interaction, resulting in complete compromise of confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.