Skip to content
Threat Feed
Subscribe

Product

Cms

2 briefs RSS
critical advisory

CVE-2021-47964: Schlix CMS Remote Code Execution via Malicious Extension Upload

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability, tracked as CVE-2021-47964, allowing authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager and triggering execution by accessing the 'About' tab.

CMS CVE-2021-47964 rce schlix cms php
2r 1t 1c
high advisory

Kirby CMS Server-Side Template Injection via Double Template Resolution

A server-side template injection (SSTI) vulnerability exists in Kirby CMS within the option rendering feature due to double template resolution in option fields (checkboxes, color, multiselect, select, radio, tags, or toggles) when using options from a query or API with untrusted values, potentially allowing attackers to inject malicious queries.

cms ssti kirby template-injection
2r 1t