CVSS: 7.5EPSS: 2%CPEs: 20EXPL: 2CVE-2011-5005 – QuiXplorer 2.3 - Bugtraq Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2011-5005
Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the upload action to index.php, then accessing it via a direct request to the file in an unspecified directory. Vulnerabilidad de subida no restringida de ficheros en QuiXplorer v2.3 y anteriores permite a atacantes remotos ejecutar código de su elección al subir un fichero con una extensión ejecutable usando la opción de subir en index.php, accediendo posteriormente mediante una petición directa del fichero en un directorio no especificado • https://www.exploit-db.com/exploits/18118 http://www.exploit-db.com/exploits/18118 https://exchange.xforce.ibmcloud.com/vulnerabilities/71323 •
CVSS: 6.8EPSS: 81%CPEs: 69EXPL: 2CVE-2009-1911 – TinyWebGallery 1.7.6 - Local File Inclusion / Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-1911
Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and earlier, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to admin/index.php. Vulnerabilidad de salto de directorio en .include/init.php (también conocido como admin/_include/init.php) en QuiXplorer v2.3.2 y anteriores, utilizado en TinyWebGallery v1.7.6 y anteriores, permite a los atacantes remotos, incluir y ejecutar arbitrariamente archivos locales a través de ..(punto punto) en el parámetro "lang" para admin/index.php. • https://www.exploit-db.com/exploits/8649 http://secunia.com/advisories/35020 http://secunia.com/advisories/35060 http://www.securityfocus.com/archive/1/503396/100/0/threaded http://www.securityfocus.com/bid/34892 http://www.tinywebgallery.com/forum/viewtopic.php?t=1653 https://exchange.xforce.ibmcloud.com/vulnerabilities/50408 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •