CVE-2017-16903
Last modified
CVE-2017-16903 is a vulnerability of currently unknown severity. LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php.. EPSS estimates a 2.05% chance of exploitation in the next 30 days.
Description
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lvyecms Project | Lvyecms | <= 3.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-16903?
How severe is CVE-2017-16903?
How do I fix CVE-2017-16903?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-16897A vulnerability has been discovered in the Auth0 passport-ws…
- CVE-2017-16898The printMP3Headers function in util/listmp3.c in libming v0…
- CVE-2017-16899An array index error in the fig2dev program in Xfig 3.2.6a a…
- CVE-2017-1690IBM Rational Quality Manager and IBM Rational Collaborative …5.4
- CVE-2017-16900Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 …5.5
- CVE-2017-16902On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending …
- CVE-2017-16904The Public tologin feature in admin.php in LvyeCMS through 3…
- CVE-2017-16905The DuoLingo TinyCards application before 1.0 for Android ha…
- CVE-2017-16906In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL f…
- CVE-2017-16907In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the C…
- CVE-2017-16908In Horde Groupware 5.2.19, there is XSS via the Name field d…
- CVE-2017-16909An error related to the "LibRaw::panasonic_load_raw()" funct…
Are you affected by CVE-2017-16903?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST