VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Nov 20, 2017· Updated Jun 17, 2026

CVE-2017-16903

CVE-2017-16903

Description

LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php.

Affected products

2
  • Lvyecms Project/Lvyecms2 versions
    cpe:2.3:a:lvyecms_project:lvyecms:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:lvyecms_project:lvyecms:*:*:*:*:*:*:*:*range: <=3.1
    • (no CPE)range: <=3.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.