https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 06:35:27 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-38356 cnvd-2017-38356 https://cve.radiocsirt.org/vuln/cnvd-2017-38356 https://cve.radiocsirt.org/vuln/euvd-2026-79302 EUVD-2026-79302 https://cve.radiocsirt.org/vuln/euvd-2026-79302 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16941 <p>October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says &#34;I don&#39;t think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.</p> <p>October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says &#34;I don&#39;t think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-16941 https://cve.radiocsirt.org/vuln/ghsa-qhc2-3cg3-6xhg <p>** DISPUTED ** October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says &#34;I don&#39;t think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.&#34;</p> <p>** DISPUTED ** October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says &#34;I don&#39;t think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.&#34;</p> https://cve.radiocsirt.org/vuln/ghsa-qhc2-3cg3-6xhg https://cve.radiocsirt.org/vuln/gsd-2017-16941 gsd-2017-16941 https://cve.radiocsirt.org/vuln/gsd-2017-16941