CVE-2019-9611

An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter, to write arbitrary content (in the file_content parameter) into an arbitrary file (specified by the file_name parameter). This is related to the save function in TemplateController.java.

• CWE-22

• https://www.seebug.org/vuldb/ssvid-97839Exploit, Third Party Advisory
• https://www.seebug.org/vuldb/ssvid-97839Exploit, Third Party Advisory

Published

Mar 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9605PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 h…
• CVE-2019-9606PHP Scripts Mall Personal Video Collection Script 4.0.4 has …
• CVE-2019-9607PHP Scripts Mall Medical Store Script 3.0.3 allows Path Trav…
• CVE-2019-9608An issue was discovered in OFCMS before 1.1.3. Remote attack…
• CVE-2019-9609An issue was discovered in OFCMS before 1.1.3. Remote attack…
• CVE-2019-9610An issue was discovered in OFCMS before 1.1.3. It has admin/…
• CVE-2019-9612An issue was discovered in OFCMS before 1.1.3. Remote attack…
• CVE-2019-9613An issue was discovered in OFCMS before 1.1.3. Remote attack…
• CVE-2019-9614An issue was discovered in OFCMS before 1.1.3. A command exe…
• CVE-2019-9615An issue was discovered in OFCMS before 1.1.3. It allows adm…
• CVE-2019-9616An issue was discovered in OFCMS before 1.1.3. Remote attack…
• CVE-2019-9617An issue was discovered in OFCMS before 1.1.3. Remote attack…