CVE-2019-6714

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.

• CWE-22

• http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jun/26
• https://blogengine.io/Product
• https://github.com/rxtur/BlogEngine.NET/Product, Third Party Advisory
• https://www.exploit-db.com/exploits/46353/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jun/26
• https://blogengine.io/Product
• https://github.com/rxtur/BlogEngine.NET/Product, Third Party Advisory
• https://www.exploit-db.com/exploits/46353/Exploit, Third Party Advisory, VDB Entry

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6703Incorrect access control in migla_ajax_functions.php in the …
• CVE-2019-6706Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c.…7.5
• CVE-2019-6707PHPSHE 1.7 has SQL injection via the admin.php?mod=product&a…
• CVE-2019-6708PHPSHE 1.7 has SQL injection via the admin.php?mod=order sta…
• CVE-2019-6710Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CS…
• CVE-2019-6713app\admin\controller\RouteController.php in ThinkCMF 5.0.190…
• CVE-2019-6715pub/sns.php in the W3 Total Cache plugin before 0.9.4 for Wo…7.5
• CVE-2019-6716An unauthenticated Insecure Direct Object Reference (IDOR) i…
• CVE-2019-6719An issue has been found in libIEC61850 v1.3.1. There is a us…
• CVE-2019-6724The barracudavpn component of the Barracuda VPN Client prior…
• CVE-2019-6725The rpWLANRedirect.asp ASP page is accessible without authen…
• CVE-2019-6726The WP Fastest Cache plugin through 0.8.9.0 for WordPress al…