CVE-2022-27061

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

• CWE-434

• http://packetstormsecurity.com/files/166659/AeroCMS-0.0.1-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://drive.google.com/file/d/1PdF7gTUt_QuU2ObS9YUVew6orHaho-QF/view?usp=sharingExploit, Third Party Advisory
• https://github.com/D4rkP0w4r/AeroCMS-Unrestricted-File-Upload-POCExploit, Third Party Advisory
• http://packetstormsecurity.com/files/166659/AeroCMS-0.0.1-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://drive.google.com/file/d/1PdF7gTUt_QuU2ObS9YUVew6orHaho-QF/view?usp=sharingExploit, Third Party Advisory
• https://github.com/D4rkP0w4r/AeroCMS-Unrestricted-File-Upload-POCExploit, Third Party Advisory

Published

Apr 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-27049Raidrive before v2021.12.35 allows attackers to arbitrarily …2
• CVE-2022-2705A vulnerability was found in SourceCodester Simple Student I…9.8
• CVE-2022-27050BitComet Service for Windows before version 1.8.6 contains a…7.8
• CVE-2022-27052FreeFtpd version 1.0.13 and below contains an unquoted servi…7.8
• CVE-2022-27055ecjia-daojia 1.38.1-20210202629 is vulnerable to information…7.5
• CVE-2022-2706A vulnerability classified as critical has been found in Sou…9.8
• CVE-2022-27062AeroCMS v0.0.1 was discovered to contain a stored cross-site…4.8
• CVE-2022-27063AeroCMS v0.0.1 was discovered to contain a stored cross-site…6.1
• CVE-2022-27064Musical World v1 was discovered to contain an arbitrary file…8.8
• CVE-2022-2707A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2022-27076Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a co…9.8
• CVE-2022-27077Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a co…9.8