CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-40037
https://notcve.org/view.php?id=CVE-2022-40037
An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile. Un problema descubierto en Rawchen blog-ssm v1.0 permite a un atacante remoto escalar privilegios y ejecutar comandos arbitrarios a través del componente /upFile. • https://github.com/rawchen/blog-ssm/issues/2 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-40034
https://notcve.org/view.php?id=CVE-2022-40034
Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter. La vulnerabilidad de cross-site scripting (XSS) encontrada en Rawchen blog-ssm v1.0 permite a los atacantes ejecutar código arbitrario a través del parámetro 'notifyInfo'. • https://github.com/rawchen/blog-ssm/issues/4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •