CVE Vulnerability Advisory Database

[Affected Scope] EyouCMS up to version 1.7.1 and 5.0, specifically within the Member Avatar Handler component.

[Impact] Unauthenticated remote attackers can bypass access controls to upload arbitrary files or trigger file inclusion, leading to complete Remote Code Execution (RCE).

[Mitigation] Restrict external access to the vulnerable API endpoint, deploy WAF rules, and monitor for official vendor patches.

[Affected Scope] xiweicheng TMS up to and including version 2.28.0

[Impact] Unauthenticated remote attackers can upload arbitrary malicious files, leading to Remote Code Execution (RCE) on the target server

[Mitigation] Disable execution permissions on the upload directory, enforce strict file extension validation, or apply the latest security patches

[Affected Scope] code-projects Content Management System 1.0, specifically the /admin/edit_posts.php component.

[Impact] Remote attackers can bypass authorization to upload malicious PHP web shells, leading to arbitrary system command execution on the host server.

[Mitigation] Implement strict file extension validation in the source code, disable script execution in the upload directory, or deploy WAF rules.

[Affected Scope] SAP systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader component.

[Impact] Unauthenticated remote attackers can upload malicious executable binaries (such as web shells), leading to complete compromise of system confidentiality, integrity, and availability.

[Mitigation] Immediately apply the official security patch (SAP Note 3594142) and restrict external access to the Metadata Uploader endpoints.

[Affected Scope] TeamT5 ThreatSonar Anti-Ransomware platform

[Impact] Remote attackers with administrator privileges can upload malicious files to execute arbitrary system commands on the server

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to the admin console