CVE-2021-44911

XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restrict...

PT-2022-12262

Name of the Vulnerable Software and Affected Versions XE versions prior to 1.11.6 Description The issue allows for unrestricted file upload via the modules/menu/menu.admin.controller.php module. When uploading the Mouse over button and the When selected button, there is no restriction on the file...

CVE-2021-44911: Improper Neutralization of Input During Web Page Generation

XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restrict...