CVE-2021-37770

Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.

• CWE-434

• https://github.com/NucleusCMS/NucleusCMS/issues/96Exploit, Issue Tracking, Third Party Advisory
• https://shimo.im/docs/Ch9CphJt8XwTvQ3dExploit, Third Party Advisory
• https://github.com/NucleusCMS/NucleusCMS/issues/96Exploit, Issue Tracking, Third Party Advisory
• https://shimo.im/docs/Ch9CphJt8XwTvQ3dExploit, Third Party Advisory

Published

Jun 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3776showdoc is vulnerable to Cross-Site Request Forgery (CSRF)5.4
• CVE-2021-37760A Session ID leak in the audit log in Graylog before 4.1.2 a…9.8
• CVE-2021-37761Zoho ManageEngine ADManager Plus version 7110 and prior is v…9.8
• CVE-2021-37762Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37764Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_s…8.1
• CVE-2021-3777nodejs-tmpl is vulnerable to Inefficient Regular Expression …7.5
• CVE-2021-37774An issue was discovered in function httpProcDataSrv in TL-WD…8
• CVE-2021-37777Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Refer…7.5
• CVE-2021-37778There is a buffer overflow in gps-sdr-sim v1.0 when parsing …9.8
• CVE-2021-3778vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-37781Employee Record Management System v 1.2 is vulnerable to Cro…5.4
• CVE-2021-37782Employee Record Management System v 1.2 is vulnerable to SQL…9.8