CVE-2021-30149

Composr CMS 10.0.36 is vulnerable to remote code execution via PHP file upload. The vulnerability allows uploading and executing PHP files (e.g., via galleries or bulk upload paths), leading to high-impact outcomes (RCE) as indicated by multiple sources (CVE-2021-30149, exploit/public disclosures...

CVE-2021-30150

CVE-2021-30150 affects Composr 10.0.36, with a stored/reflected XSS in an XML script via the vulnerable endpoint data/ajax_tree.php?hook=choose_gallery... where a crafted XML/HTML-like payload can execute script code in the context of the page. Public writeups (PacketStorm exploit article and Exp...

CVE-2021-46360

Composr-CMS 10.0.39 and earlier is affected by an authenticated remote code execution vulnerability. The issue allows an authenticated attacker to upload a PHP shell via /adminzone/index.php?page=admin-commandr, enabling arbitrary code execution on the server. Public exploit references exist (e.g...