Remote code execution

RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default...

CVE-2021-46367

Summary (CVE-2021-46367): RiteCMS 3.1.0 and earlier contains a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htaccess configuration to execute PHP files in the media/files directories, leading to remote code execution. Root...

PT-2022-12675

Name of the Vulnerable Software and Affected Versions RiteCMS versions 3.1.0 and below Description The issue allows an authenticated attacker to upload a PHP file and bypass the .htaccess configuration, which by default denies execution of .php files in the media and files directory. This can be...

HorizontCMS Code Issues Vulnerabilities

HorizontCMS is a customer relationship management web platform for individual developers. A security vulnerability exists in HorizontCMS before 1.0.0-beta.3, which can be exploited by attackers to upload .htaccess and .hello files by using the media file upload feature...

CVE-2021-28428

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

Unrestricted file upload

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

CVE-2021-28428

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

CVE-2021-28428: Unrestricted Upload of File with Dangerous Type

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

PT-2022-9891

Name of the Vulnerable Software and Affected Versions HorizontCMS versions prior to 1.0.0-beta.3 Description The issue allows for remote code execution by uploading specific files, such as .htaccess and .hello files, through the Media Files upload functionality. This bypasses the filter that was...

HorizontCMS 代码问题漏洞

HorizontCMS is a customer relationship management web platform for individual developers. A security vulnerability exists in HorizontCMS before 1.0.0-beta.3, which can be exploited by attackers to upload .htaccess and .hello files by using the media file upload feature...

CVE-2022-1166

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the we...

TaoCMS Code Injection Vulnerability (CNVD-2022-33839)

TaoCMS is a CMS web content management system with perfect support for multiple databases Sqlite/Mysql. TaoCMS has a code injection vulnerability that can be exploited by attackers to execute code injection by arbitrarily editing .htaccess files to execute malicious code or write malicious code...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

Code injection

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

CVE-2022-25578

Summary: CVE-2022-25578 affects taocms 3.0.2, where code execution can occur by arbitrarily editing the .htaccess file. The vulnerability centers on code injection via .htaccess edits, enabling potential webshell or malicious code execution. What’s affected: taocms version 3.0.2 (CMS web applicat...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

PT-2022-17380 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: The issue allows attackers to execute code injection via arbitrarily editing the .htaccess file. Recommendations: For taocms version 3.0.2, restrict access to the .htaccess file to prevent arbitrary edits and...

Taocms 代码注入漏洞

TaoCMS is a CMS web content management system with perfect support for multiple databases Sqlite/Mysql. TaoCMS has a code injection vulnerability that can be exploited by attackers to execute code injection by arbitrarily editing .htaccess files to execute malicious code or write malicious code...