CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418: Unrestricted Upload of File with Dangerous Type

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

PT-2018-15403

Name of the Vulnerable Software and Affected Versions S-CMS version 1.0 Description The issue allows unauthorized access to certain files, including PHP source code, by manipulating the DownName parameter in the "admin/download.php" endpoint with a mixed-case file extension. For example, using...