Unrestricted file upload vulnerability in the \Add Image Macro\ feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the uploaded file.