Jing-Xun Sun

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.

**Name of the Vulnerable Software and Affected Versions** CAYIN CMS-WS (affected versions not specified) CAYIN CMS-SE (affected versions not specified) **Description** Missing authentication allows unauthenticated remote attackers to obtain media file lists through specific functionality, leading to partial information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.