CVE-2019-7721

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5

Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters.

Recommendations For nc-cms version 3.5, restrict access to the index.php?action=save endpoint to prevent the upload of malicious .php files. Consider temporarily disabling the file upload functionality until a fix is available. Avoid using the name and editordata parameters in the affected endpoint until the issue is resolved.