Filtered by vendor Wolfcms
Subscriptions
Filtered by product Wolfcms
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-67206 | 1 Wolfcms | 1 Wolfcms | 2026-07-31 | 8.8 High |
| Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP. | ||||
| CVE-2026-67207 | 1 Wolfcms | 1 Wolfcms | 2026-07-30 | 8.8 High |
| Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges. | ||||
Page 1 of 1.