CVE-2017-9602

KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the file upload and deletion functionality. Through this functionality, a user can upload an ASPX script to Uploads/Documents/ to run any arbitrary code.

• CWE-732

• https://www.exploit-db.com/exploits/42184/Mitigation, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42184/Mitigation, Third Party Advisory, VDB Entry

Published

Jun 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9596The "CFB Mobile Banking" by Citizens First Bank Wisconsin ap…
• CVE-2017-9597The "Blue Ridge Bank and Trust Co. Mobile Banking" by Blue R…
• CVE-2017-9598The "Morton Credit Union Mobile Banking" by Morton Credit Un…
• CVE-2017-9599The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPAN…
• CVE-2017-9600The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- a…
• CVE-2017-9601The "FNB Kemp Mobile Banking" by First National Bank of Kemp…
• CVE-2017-9603SQL injection vulnerability in the WP Jobs plugin before 1.5…
• CVE-2017-9604KDE kmail before 5.5.2 and messagelib before 5.5.2, as distr…
• CVE-2017-9605The vmw_gb_surface_define_ioctl function (accessible via DRM…
• CVE-2017-9606Infotecs ViPNet Client and Coordinator before 4.3.2-42442 al…
• CVE-2017-9607The BL1 FWU SMC handling code in ARM Trusted Firmware before…7
• CVE-2017-9608The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3…