Total vulnerabilities in the database
editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. (dot dot) sequences in the file parameter.
CVSS v2:
No CWE or OWASP classifications available.