Unauthenticated arbitrary file upload on the https://█████/ (█████████)

How it was found

Description

I was able to identify unsafe upload endpoint on the https://█████/upload.php

POC

1. Go to the https://█████████/upload.php
2. Upload some test file. You will see success message: ████
3. Visit https://███/delete.me and you will see your uploaded file there I uploaded example test file with string test file █████████

Impact

Arbitrary file upload, may lead to the Stored XSS, hosting attacker's content and code execution.