CVE-2019-9829

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.mdExploit, Third Party Advisory
https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.mdExploit, Third Party Advisory

Timeline

Published: Mar 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98317.5The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /CVE-2019-98327.5The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket con CVE-2019-98337.5The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-s CVE-2019-98346.1The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HT CVE-2019-98359.6The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it CVE-2019-98365.3Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) CVE-2019-98376.1Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redire CVE-2019-98386.1VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.CVE-2019-98396.1VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.CVE-2019-98416.1Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.CVE-2019-98427.2madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, becau CVE-2019-98437.5In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entit