Tilde CMS 1.0.1 vulnerabilities

3 known CVE vulnerabilities in Tilde CMS 1.0.1, translated and rated.

CVE-2017-11326High
An issue was discovered in Tilde CMS version 1.0.1 that allows bypassing the implemented restrictions on arbitrary file upload via filename manipulation with .php extension.
CVE-2017-11325High
An issue was discovered in Tilde CMS version 1.0.1 that allows arbitrary files to be read via a file=../ attack on actionphp/download.File.php.
CVE-2017-11324Critical
An issue was discovered in Tilde CMS version 1.0.1 due to missing escaping of the backtick character, leading to SQL Injection vulnerability in the SELECT query in class.SystemAction.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS