Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper, for example before the XE 1.11.2 version, you can upload the PHP type file to GETSHELL.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
XpressEngine 跨站脚本漏洞
Vulnerability Description
XpressEngine是一个 CMS（内容管理系统），任何人都可以轻松、方便、自由地发布内容。 XpressEngine 存在安全漏洞，该漏洞源于在XE 1.116中，当上传Normal按钮时，对文件后缀没有限制。攻击者可利用该漏洞导致任何文件被上传到文件目录。
CVSS Information
N/A
Vulnerability Type
N/A