PivotX 2.3.11 vulnerabilities
4 known CVE vulnerabilities in PivotX 2.3.11, translated and rated.
- CVE-2017-14958High
lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.
- CVE-2017-8402High
PivotX version 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.
- CVE-2017-7570High
PivotX version 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by uploading a file with a safe extension (such as .jpg) and then invoking the duplicate function to change the extension to .php.
- CVE-2015-5457High
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, allowing remote attackers to execute arbitrary code by uploading a crafted file.