CVE-2020-35362

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter the attacker must provide the correct fileOrgName value...

PT-2020-17315

Name of the Vulnerable Software and Affected Versions DEXT5Upload versions 2.7.1262310 and earlier Description The issue allows remote files to be downloaded via a "dext5CMD=downloadRequest" action with traversal in the fileVirtualPath parameter, provided the attacker has the correct fileOrgName...

CVE-2020-35362: Improper Limitation of a Pathname to a Restricted Directory

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter the attacker must provide the correct fileOrgName value...

Remote code execution

A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/...

PT-2020-13543

Name of the Vulnerable Software and Affected Versions DEXT5 versions through 2.7.1402870 Description A remote code execution issue exists due to a vulnerability in DEXT5Upload. This allows an attacker to upload a PHP file via the "dext5handler.jsp" handler, as the uploaded file is stored under...

CVE-2020-13442: Unrestricted Upload of File with Dangerous Type

A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/...