CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36426
https://notcve.org/view.php?id=CVE-2021-36426
File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. • https://github.com/slackero/phpwcms/issues/312 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36425
https://notcve.org/view.php?id=CVE-2021-36425
Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. • https://github.com/slackero/phpwcms/issues/311 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-36424
https://notcve.org/view.php?id=CVE-2021-36424
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. • https://github.com/slackero/phpwcms/issues/310 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2021-4301 – slackero phpwcms sql injection
https://notcve.org/view.php?id=CVE-2021-4301
A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. • https://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9d https://github.com/slackero/phpwcms/releases/tag/v1.9.27 https://vuldb.com/?ctiid.217418 https://vuldb.com/?id.217418 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4302 – slackero phpwcms SVG File cross site scripting
https://notcve.org/view.php?id=CVE-2021-4302
A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. • https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54 https://github.com/slackero/phpwcms/releases/tag/v1.9.27 https://vuldb.com/?ctiid.217419 https://vuldb.com/?id.217419 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •