CVE-2015-2994

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows...

6.5 MediumPublic exploit

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.

Exploit likelihood

49.8%Down 2.8 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2015-2994
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-2994
Updated: 2026-11-02

EUVDEUVD-2015-3076 No score

Record: EUVD-2015-3076
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g763-4gcm-875f No score

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows...

Record: GHSA-g763-4gcm-875f
Updated: 2026-11-02

Affected products

sysaid

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	SysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)	2015-06-03
Exploit-DB	SysAid Help Desk 14.4 - Multiple Vulnerabilities	2015-06-10
Metasploit	SysAid Help Desk Administrator Portal Arbitrary File Upload	2015-06-03

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-2994 is a medium vulnerability (CVSS 6.5) in Sysaid, published June 8, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 49.8%, the 98th percentile. No source names a fixed version.