CVE-2026-6561

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Performing a manipulation of the argument filename results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-656102.4nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execu CVE-2026-656115.1nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted CVE-2026-656125.1nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or in CVE-2026-656134.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting de CVE-2026-656168.8Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.CVE-2026-656178.8A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and CVE-2026-656186.5Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog CVE-2026-65627.3A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. Execu CVE-2026-656238.7Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during CVE-2026-656246.9Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust CVE-2026-65638.8A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /gofor CVE-2026-656337.6Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API creden