GHSA-JVWG-PHXX-J3RP October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations

Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cmsassets or editor.tailorblueprints specifically withheld, an uncommon...

CVE-2023-39112

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

Arbitrary file deletion

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...

CVE-2023-39112

ECShop v4.1.16 has an arbitrary file deletion vulnerability in the Admin Panel (CVE-2023-39112). Public sources confirm the affected product/version and impact on integrity and availability, with CVSS 3.1 metrics: I:H, A:H, C:N; no details on root cause in the provided documents. No exploitation ...

CVE-2023-39112

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel...