CVE-2026-66398 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...

CVE-2022-28912

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW...

CVE-2017-9444

BigTree CMS up to version 4.2.18 is affected by CSRF vulnerabilities in several administrative endpoints: core/admin/modules/users/profile/update.php (modify user information), index.php/admin/developer/packages/delete/ (remove packages), index.php/admin/developer/upgrade/ignore/?versions=, and i...