CVE-2016-9835

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2016-9835

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9835.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2016-9835

Published

2016-12-05T08:59:02.673Z

Modified

2026-07-08T12:53:52.676475Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.

References

Affected packages

Git / github.com/zikula/core

Affected ranges

Type

GIT

Repo

https://github.com/zikula/core

Events

Introduced

71034818069ac474668538de6b02d516458813d0

Last affected

8450dbda94ce0714988504e6945a3d008ca2ef53

Database specific

{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.3.10:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc5:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc4:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.3:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.3:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:zikula:zikula_application_framework:1.4.3:rc2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.3.0"
        },
        {
            "last_affected": "1.3.0"
        },
        {
            "introduced": "1.3.1"
        },
        {
            "last_affected": "1.3.1"
        },
        {
            "introduced": "1.3.2"
        },
        {
            "last_affected": "1.3.2"
        },
        {
            "introduced": "1.3.3"
        },
        {
            "last_affected": "1.3.3"
        },
        {
            "introduced": "1.3.4"
        },
        {
            "last_affected": "1.3.4"
        },
        {
            "introduced": "1.3.5"
        },
        {
            "last_affected": "1.3.5"
        },
        {
            "introduced": "1.3.6"
        },
        {
            "last_affected": "1.3.6"
        },
        {
            "introduced": "1.3.7"
        },
        {
            "last_affected": "1.3.7"
        },
        {
            "introduced": "1.3.8"
        },
        {
            "last_affected": "1.3.8"
        },
        {
            "introduced": "1.3.9"
        },
        {
            "last_affected": "1.3.9"
        },
        {
            "introduced": "1.3.10"
        },
        {
            "last_affected": "1.3.10"
        },
        {
            "introduced": "1.3.10-rc1"
        },
        {
            "last_affected": "1.3.10-rc1"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        },
        {
            "introduced": "1.4.0-rc5"
        },
        {
            "last_affected": "1.4.0-rc5"
        },
        {
            "introduced": "1.4.0-rc1"
        },
        {
            "last_affected": "1.4.0-rc1"
        },
        {
            "introduced": "1.4.0-rc2"
        },
        {
            "last_affected": "1.4.0-rc2"
        },
        {
            "introduced": "1.4.0-rc3"
        },
        {
            "last_affected": "1.4.0-rc3"
        },
        {
            "introduced": "1.4.0-rc4"
        },
        {
            "last_affected": "1.4.0-rc4"
        },
        {
            "introduced": "1.4.1"
        },
        {
            "last_affected": "1.4.1"
        },
        {
            "introduced": "1.4.2"
        },
        {
            "last_affected": "1.4.2"
        },
        {
            "introduced": "1.4.3"
        },
        {
            "last_affected": "1.4.3"
        },
        {
            "introduced": "1.4.3-rc3"
        },
        {
            "last_affected": "1.4.3-rc3"
        },
        {
            "introduced": "1.4.3-rc1"
        },
        {
            "last_affected": "1.4.3-rc1"
        },
        {
            "introduced": "1.4.3-rc2"
        },
        {
            "last_affected": "1.4.3-rc2"
        }
    ]
}

Affected versions

1.*

1.3.0

1.3.1

1.3.10

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4.0

1.4.0-rc1

1.4.0-rc2

1.4.0-rc3

1.4.0-rc4

1.4.0-rc5

1.4.1

1.4.2

1.4.3

1.4.3-rc1

1.4.3-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9835.json"