Product
C97net qEngine CMS, Kemana Directory, and Cart Engine are vulnerable to an unrestricted file upload flaw allowing authenticated Editor-role users to achieve remote code execution.