CVE-2019-8433

JTBCPHP 3.0.1.8 allows Arbitrary File Upload via the console//console/file/manage.php?type=list URI, as demonstrated by a .php file...

CVE-2018-17836

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...