All packages
BlackCat CMS 1.2 vulnerabilities
3 known CVE vulnerabilities in BlackCat CMS 1.2, translated and rated.
- CVE-2017-14399High
In BlackCat CMS version 1.2.2, unrestricted file upload is possible in backend/media/ajax_rename.php via the extension parameter, allowing the extension to be changed from .jpg to .php.
- CVE-2017-14050High
In BlackCat CMS version 1.2, the backend/addons/install.php file allows remote authenticated users to execute arbitrary PHP code via a ZIP archive containing a .php file.
- CVE-2017-14048High
BlackCat CMS version 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. This can also be exploited via CSRF.