Kritik CVSS 9.1
CVE-2026-49849: CVE-2026-49849: tehlikeli dosya yükleme
Açıklama (NVD)
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
Özet bilgiler
- CVSS v3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS
- %0,99 (yüzdelik 63)
- CWE
- CWE-434
- Yama
- Yok / bilinmiyor