Kamil Szczurowski

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input sent to the 'pjAdminPolls.controller.php' endpoint. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Improper neutralization of user-provided input in parameters used for sorting functions allows an unauthenticated attacker to execute SQL Injection attacks. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

A reflected cross-site scripting (XSS) issue allows an attacker to execute arbitrary JavaScript in a user's browser by inducing them to open a specially crafted URL.

A Cross-Site Request Forgery (CSRF) issue exists due to the absence of CSRF tokens or appropriate SameSite attributes. This allows an attacker to send unauthorized requests using the session of an authenticated user, which can result in unauthorized administrative actions, including the creation of new admin accounts. CSRF is a technique where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated.

An authenticated SQL injection occurs due to improper neutralization of input provided by a user into parameters used for sorting functions. This allows an authenticated attacker to execute arbitrary SQL commands.

A Remote Code Execution issue exists due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload, enabling the execution of arbitrary code on the underlying server.

Insufficient input sanitization in the Members in Control Panel allows attackers to interact with the underlying database via Blind SQL Injection. This technique involves sending queries that the database answers with a boolean (true/false) or a time delay, enabling the extraction of sensitive information such as user credentials.

Path traversal allows attackers with privileges to edit templates to read and write any file on the application server that the application has permissions to access. This can lead to Remote Code Execution, which is the ability to execute arbitrary commands on the target machine.

Reflected Cross-Site Scripting (XSS) occurs when the application improperly handles user input in certain requests. This allows attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link.

Stored Cross-Site Scripting occurs because the application fails to properly sanitize user input in user posts and user profile fields. This allows low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser when the content is viewed.

Lack of protective mechanisms leads to a Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks an authenticated user into performing unintended actions.

An authenticated attacker can cause a Denial of Service (DoS) by sending multiple concurrent requests to view user profiles. On instances with a large number of registered users, this action exhausts database resources, resulting in a complete loss of application access for other users.

An unauthenticated attacker can upload files of any type and extension without restriction via the 'dialog.php' endpoint. This unrestricted file upload can lead to Remote Code Execution, which allows an attacker to execute arbitrary code on the server.

Privilege Escalation occurs due to excessive database privileges assigned to the application user. An attacker with access to a running application instance connected to the backend server can extract database credentials from the application's memory by inspecting the running process. These exposed credentials provide administrative access to the database, allowing actions that exceed the privileges required for normal application functionality and those permitted through the application interface.

mpGabinet performs client-side authentication, which is a process where the verification of user credentials happens on the user's device rather than the server. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary to authenticate as an arbitrary user.

Some increased actor activities are shown targeting BinSoft mpGabinet (CVE-2026-40552) https://t.co/mUbccZwq7B

The file upload functionality in PAD CMS allows an unauthenticated remote attacker to upload files of any type and extension without restriction. This is due to a client-controlled permission check parameter. Successful exploitation can lead to Remote Code Execution. The issue affects all three templates: www, bip, and ww+bip. The product is End-Of-Life and the producer will not publish patches for this vulnerability.

The software’s photo upload functionality allows a remote attacker to upload files of any type and extension without restriction due to a client-controlled permission check parameter. This can lead to Remote Code Execution. The issue affects all three templates: `www`, `bip`, and `ww+bip`. The product is End-Of-Life and the producer will not release patches for this issue.