CVE-2026-49849criticalCWE-434

CVE-2026-49849: falha crítica em 4xmen xshop

xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar xshop

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 1.0%
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
4xmen · xshop