https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 05:58:37 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-06418 cnvd-2018-06418 https://cve.radiocsirt.org/vuln/cnvd-2018-06418 https://cve.radiocsirt.org/vuln/euvd-2026-63244 EUVD-2026-63244 https://cve.radiocsirt.org/vuln/euvd-2026-63244 https://cve.radiocsirt.org/vuln/fkie_cve-2018-7486 <p>Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude(&#34;../pathname/executable.jpeg&#34;)[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.</p> <p>Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude(&#34;../pathname/executable.jpeg&#34;)[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-7486 https://cve.radiocsirt.org/vuln/ghsa-pcgv-6rcf-4897 <p>Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude(&#34;../pathname/executable.jpeg&#34;)[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.</p> <p>Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude(&#34;../pathname/executable.jpeg&#34;)[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.</p> https://cve.radiocsirt.org/vuln/ghsa-pcgv-6rcf-4897 https://cve.radiocsirt.org/vuln/gsd-2018-7486 gsd-2018-7486 https://cve.radiocsirt.org/vuln/gsd-2018-7486