CVE-2020-27386

Vulnerability (CVE-2020-27386) in FlexDotnetCMS prior to 1.5.9 allows an authenticated attacker to upload arbitrary files via the FileManager, upload a safe file (e.g., TXT), rename it to an executable extension (e.g., ASP) using FileEditor or FileManager rename, and execute it via HTTP GET. Impa...

CVE-2020-27385

FlexDotnetCMS contains an Incorrect Access Control vulnerability in the FileEditor (/Admin/Views/FileEditor/) affecting versions before 1.5.11. An authenticated remote attacker can read and write to existing files outside the web root. The issue is exposed via directory traversal (e.g., ............