CVE-2018-14440

CVE-2018-14440 describes an SQL injection in the fictional product “cckevincyh SSH CompanyWebsite” affecting versions up to 2018-05-03, reachable via the admin/noticeManageAction_queryNotice.action?noticeInfo parameter. The issue arises from unsanitized input on this parameter, enabling potential...

CVE-2018-14441

CVE-2018-14441 describes an arbitrary file upload in the admin/fileUploadAction_fileUpload.action of cckevincyh SSH CompanyWebsite, affected through 2018-05-03. The issue allows uploading a .jsp file with an image/jpeg content type, enabling potential remote code execution via a uploaded JSP, as ...