https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 23:18:44 +0000 https://cve.radiocsirt.org/vuln/cve-2018-18572 <p>osCommerce 2.3.4.1 has an incomplete &#39;.htaccess&#39; for blacklist filtering in the &#34;product&#34; page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn&#39;t execute in the application. But this filter didn&#39;t prevent the &#39;.pht&#39; extension. Thus, remote authenticated administrators can upload &#39;.pht&#39; files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&amp;action=new_product URI.</p> <p>osCommerce 2.3.4.1 has an incomplete &#39;.htaccess&#39; for blacklist filtering in the &#34;product&#34; page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn&#39;t execute in the application. But this filter didn&#39;t prevent the &#39;.pht&#39; extension. Thus, remote authenticated administrators can upload &#39;.pht&#39; files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&amp;action=new_product URI.</p> https://cve.radiocsirt.org/vuln/cve-2018-18572