漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
Vulnerability Description
In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper, for example before the XE 1.11.2 version, you can upload the PHP type file to GETSHELL.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
XpressEngine 跨站脚本漏洞
Vulnerability Description
XpressEngine是一个 CMS（内容管理系统），任何人都可以轻松、方便、自由地发布内容。 XpressEngine 存在安全漏洞，该漏洞源于在XE 1.116中，当上传Normal按钮时，对文件后缀没有限制。攻击者可利用该漏洞导致任何文件被上传到文件目录。
CVSS Information
N/A
Vulnerability Type
N/A