SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.
https://sawatdee.github.io/post/2021/12/24/First-CVEs.html
https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US