taocms vulnerabilities

An issue was discovered in taocms 3.0.2 in the website settings that allows arbitrary PHP code to be injected by modifying config.php.

A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.

Taocms versions up to 3.0.2 are vulnerable to Cross Site Scripting (XSS), allowing attackers to inject malicious code into the application.