Vendor
UnoPim versions prior to 2.1.5 allow authenticated administrators to execute arbitrary code via an insecure TinyMCE image upload endpoint that fails to validate file extensions.