CVE-2018-9992

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5

Description The issue concerns a security problem where an attacker can inject malicious code. This is possible through the name field when creating a new "File" or "Directory" on the admin screen, specifically at the "plugin/file manager/browse/" endpoint.

Recommendations For Frog CMS version 0.9.5, as a temporary workaround, consider restricting access to the plugin/file manager/browse/ endpoint until a patch is available. Avoid using the name field in the affected endpoint until the issue is resolved.