CVE-2026-110025: falha de média gravidade em slackero phpwcms
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
Publicada em
30Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9
da publicação à arma0 dias
Publicada no NVD13 de out.
1ª PoC13 de out.
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Produtos afetados
slackero · phpwcmsPoCs públicas encontradas — 1
githubgithub.com/capivara-research/CVE-2026-110025★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — slackero phpwcms
No mesmo produto, das mais perigosas para as menos.
CVE-2025-5499MEDIUMslackero phpwcms image_resized.php getimagesize deserializationEPSS 0.8%CVE-2021-4301MEDIUMslackero phpwcms sql injectionEPSS 0.7%CVE-2025-5497MEDIUMslackero phpwcms Feedimport processing.inc.php deserializationEPSS 0.6%CVE-2021-4302LOWslackero phpwcms SVG File cross site scriptingEPSS 0.5%CVE-2025-5498MEDIUMslackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserializationEPSS 0.5%
Referências
https://github.com/slackero/phpwcms/https://github.com/slackero/phpwcms/commit/f4c136b467565b2d16ebe2b8276b9a03547a9a69https://github.com/slackero/phpwcms/releases/tag/v1.12.4https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4https://vuldb.com/cve/CVE-2026-110025https://vuldb.com/submit/992814https://vuldb.com/vuln/417752https://vuldb.com/vuln/417752/cti