https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:14:12 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-63981 cnvd-2020-63981 https://cve.radiocsirt.org/vuln/cnvd-2020-63981 https://cve.radiocsirt.org/vuln/euvd-2026-46485 EUVD-2026-46485 https://cve.radiocsirt.org/vuln/euvd-2026-46485 https://cve.radiocsirt.org/vuln/fkie_cve-2020-27387 <p>An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager&#39;s rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/&lt;php_file_name&gt;. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.</p> <p>An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager&#39;s rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/&lt;php_file_name&gt;. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-27387 https://cve.radiocsirt.org/vuln/ghsa-fmrq-56mh-96f5 <p>An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager&#39;s rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/&lt;php_file_name&gt;. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.</p> <p>An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager&#39;s rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/&lt;php_file_name&gt;. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.</p> https://cve.radiocsirt.org/vuln/ghsa-fmrq-56mh-96f5 https://cve.radiocsirt.org/vuln/gsd-2020-27387 gsd-2020-27387 https://cve.radiocsirt.org/vuln/gsd-2020-27387