Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
XpressEngine 跨站脚本漏洞
Vulnerability Description
XpressEngine（XE）是一个 CMS（内容管理系统），任何人都可以轻松、方便、自由地发布内容。有了开源许可证，任何人都可以使用或修改它，并且作为一个开放项目，任何人都可以参与开发。 XE 存在安全漏洞，该漏洞源于在1.11.6之前的XE容易受到通过module menu.admin.controller.php上传文件的无限制限制，当上传“鼠标悬停”按钮和“选中”按钮时，对文件后缀没有限制，将任何文件上传到文件目录。攻击者可利用该漏洞执行恶意脚本。
CVSS Information
N/A
Vulnerability Type
N/A