WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP a…
CVSS 4.0HIGH 8.6·Network·High privileges·No interaction·EPSS 0.01025·Published 2026-08-03·Fixed in 2.13.10CWE-434
WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Cod…
CVSS 4.0HIGH 8.6·Network·High privileges·No interaction·EPSS 0.01189·Published 2026-08-03·Fixed in 2.13.10CWE-94