CVE-2022-50898: high-severity vulnerability in kalyan02 NanoCMS
NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 1.3%
NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
kalyan02 · NanoCMSRelated CVEs — kalyan02 NanoCMS
In the same product, most dangerous first.