CVE-2016-10751

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2016-10751

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10751.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2016-10751

Published

2019-05-24T18:29:00.253Z

Modified

2026-07-08T12:43:07.673774Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.

References

Affected packages

Git / github.com/osclass/osclass

Affected ranges

Type

GIT

Repo

https://github.com/osclass/osclass

Events

Introduced

0fb51ef67913fd42592ccd41dd926cc5dc415261

Last affected

0fb51ef67913fd42592ccd41dd926cc5dc415261

Database specific

{
    "cpe": "cpe:2.3:a:osclass:osclass:3.6.1:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.6.1"
        },
        {
            "last_affected": "3.6.1"
        }
    ]
}

Affected versions

3.*

3.6.1

v3.*

v3.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10751.json"