Vulnerabilities

TI-2019-12175 CVE-2019-16192 · GHSA-4rqp-cqfj-7r6v

upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow…

MEDIUM 46

upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0208 Published 2019-09-09 No fix listed CWE-434

TI-2018-13342 CVE-2018-18835 · GHSA-2xg4-3vp8-p43f

upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to…

MEDIUM 45

upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01577 Published 2018-10-30 No fix listed CWE-94

Vulnerabilities

Filters

upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow…

upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to…