Filtered by vendor Diyhi Subscriptions
Filtered by product Bbs Subscriptions
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-43103 1 Diyhi 1 Bbs 2024-08-04 7.2 High
A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43097 1 Diyhi 1 Bbs 2024-08-04 7.2 High
A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code.
CVE-2021-43098 1 Diyhi 1 Bbs 2024-08-04 7.2 High
A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.
CVE-2021-43100 1 Diyhi 1 Bbs 2024-08-04 7.2 High
A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43102 1 Diyhi 1 Bbs 2024-08-04 7.2 High
A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43099 1 Diyhi 1 Bbs 2024-08-04 4.9 Medium
An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).
CVE-2021-43101 1 Diyhi 1 Bbs 2024-08-04 7.2 High
A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.