CVE-2015-5951
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which...
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands.
- Record
CVE-2015-5951- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands.
- Record
CVE-2015-5951- Updated
- 2026-11-02
EUVDEUVD-2015-5897 No score
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands.
- Record
EUVD-2015-5897- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mgwr-4fqc-qh76 No score
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which...
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands.
- Record
GHSA-mgwr-4fqc-qh76- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5951 is a critical vulnerability (CVSS 9.9) in Thomsonreuters Fatca, published January 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. No source names a fixed version.
References
packetstormsecurity.com/files/133003/Thomson-Reuters-FATCA-Arbitrary-File-Upload.html
securityfocus.com/bid/76271
seclists.org/fulldisclosure/2015/Aug/25
nvd.nist.gov/vuln/detail/CVE-2015-5951
github.com/advisories/GHSA-mgwr-4fqc-qh76