CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069

HortusFox versions prior to 6.2 are vulnerable to Remote Code Execution (RCE) via the ThemeModule::startImport() function. The root cause is the direct extraction of uploaded ZIP archives into the public web root without validating filenames, extensions, or content. An authenticated administrator...

October CMS Code Execution Vulnerability

October CMS is an open source, self-hosted content management system CMS built on the Laravel PHP framework developed by Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges. A security vulnerability exists in October CMS 1.0.428 and earlier versions, which...

CVE-2017-16941

October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a...