ExpressionEngine · Report #1267488
Authenticated RCE via page title
Validstatus
mediumseverity
14upvotes
28 May 2024disclosed
Summary
A vulnerability was identified and fixed that could have allowed authenticated users to execute arbitrary PHP code by manipulating the page title in a specific API call.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.