PT-2026-121379
CVE-2018-25439
·
تاريخ النشر
2026-10-22
·
تاريخ التحديث
2026-10-22
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str replace filter to read files like config db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾