Remote code execution

RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default...

CVE-2021-46367

Summary (CVE-2021-46367): RiteCMS 3.1.0 and earlier contains a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htaccess configuration to execute PHP files in the media/files directories, leading to remote code execution. Root...

HorizontCMS Code Issues Vulnerabilities

HorizontCMS is a customer relationship management web platform for individual developers. A security vulnerability exists in HorizontCMS before 1.0.0-beta.3, which can be exploited by attackers to upload .htaccess and .hello files by using the media file upload feature...

CVE-2021-28428

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

Unrestricted file upload

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

HorizontCMS 代码问题漏洞

HorizontCMS is a customer relationship management web platform for individual developers. A security vulnerability exists in HorizontCMS before 1.0.0-beta.3, which can be exploited by attackers to upload .htaccess and .hello files by using the media file upload feature...

CVE-2022-1166

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the we...

TaoCMS Code Injection Vulnerability (CNVD-2022-33839)

TaoCMS is a CMS web content management system with perfect support for multiple databases Sqlite/Mysql. TaoCMS has a code injection vulnerability that can be exploited by attackers to execute code injection by arbitrarily editing .htaccess files to execute malicious code or write malicious code...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

Code injection

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

CVE-2022-25578

Summary: CVE-2022-25578 affects taocms 3.0.2, where code execution can occur by arbitrarily editing the .htaccess file. The vulnerability centers on code injection via .htaccess edits, enabling potential webshell or malicious code execution. What’s affected: taocms version 3.0.2 (CMS web applicat...

CVE-2022-25578

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file...

PT-2022-17380 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: The issue allows attackers to execute code injection via arbitrarily editing the .htaccess file. Recommendations: For taocms version 3.0.2, restrict access to the .htaccess file to prevent arbitrary edits and...

Taocms 代码注入漏洞

TaoCMS is a CMS web content management system with perfect support for multiple databases Sqlite/Mysql. TaoCMS has a code injection vulnerability that can be exploited by attackers to execute code injection by arbitrarily editing .htaccess files to execute malicious code or write malicious code...

GHSA-MJ6M-246H-9W56 Improper regex in htaccess file

Impact the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path. Patches Please upgrade to...

PT-2022-17501 · Mautic · Mautic

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.5 Mautic versions prior to 4.2.0 Description: The default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. However, th...

Mautic 访问控制错误漏洞

Mautic is an open source marketing automation software from Mautic Open Source. The software monitors and manages websites, sends emails and manages customer resources. Mautic has an access control error vulnerability that stems from an incorrect regular expression in the htaccess file. A remote...

BulletProof Security < 5.8 - Admin+ Stored Cross-Site Scripting (XSS)

The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. As admin, put the following payloads: - in the htaccess File Options htaccess File Editor...