CVE-2021-46116

JPress v4.2.0 is vulnerable to remote code execution via the doUploadAndInstall function in the _AddonController. An attacker can upload a malicious file, leading to full server compromise.

An improper authorization vulnerability has been found in JPress up to version 1.0.3 in the UCenter Article Submission endpoint. Manipulation of id/userId arguments can lead to unauthorized access. The attack can be performed remotely and the exploit is publicly available.

JPress 4.2.0 is vulnerable to remote code execution (RCE) via the email template editing function in the admin panel. Attackers can inject malicious code into the template, leading to arbitrary command execution on the server.

JPress 4.2.0 is vulnerable to remote code execution via the email template editing function in the admin panel. An attacker can inject malicious code into the template, which gets executed when sending an email.

JPress 4.2.0 is vulnerable to remote code execution (RCE) via the template upload function in the admin panel. An attacker can upload a malicious template and execute arbitrary code on the server.

JPress 4.2.0 is vulnerable to remote code execution via the email template editing function in the admin panel. Attackers can inject malicious code into the template, leading to code execution on the server.

JPress v4.2.0 allows users to register an account by default. With the account, users can upload arbitrary files to the server.

In the JPress v4.2.0 admin panel, there is a function that allows template modification. Attackers can inject malicious code, leading to full site compromise.