CVE-2016-10751

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 24, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-107529.8serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles aCVE-2016-107538.8e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.CVE-2016-107548.8modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.CVE-2016-107558.8AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/lanCVE-2016-107568.8Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .CVE-2016-107578.8In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lCVE-2016-107588.8PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via theCVE-2016-107599.8The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendCVE-2016-10769.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC ContinCVE-2016-107609.8On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameterCVE-2016-107616.5Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.CVE-2016-107627.5The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.