CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2006-2529
https://notcve.org/view.php?id=CVE-2006-2529
editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, does not verify the Type parameter, which allows remote attackers to upload arbitrary file types. NOTE: It is not clear whether this is related to CVE-2006-0658. • http://secunia.com/advisories/20122 http://www.fckeditor.net/whatsnew/default.html http://www.osvdb.org/25631 http://www.securityfocus.com/bid/18029 http://www.vupen.com/english/advisories/2006/1856 •
CVSS: 5.0EPSS: 3%CPEs: 2EXPL: 4CVE-2006-0658 – FCKEditor 2.0 < 2.2 - 'FileManager connector.php' Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2006-0658
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt. • https://www.exploit-db.com/exploits/1484 https://www.exploit-db.com/exploits/3702 http://retrogod.altervista.org/fckeditor_22_xpl.html http://secunia.com/advisories/18767 http://www.securityfocus.com/archive/1/424708 http://www.vupen.com/english/advisories/2006/0502 •