[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)
Maian Pal 2.1 image uploads lack an extension allow-list, enabling PHP code execution.
44
Vendor
Maian Media
- Mentions · 7d0
- Mentions · 30d1
- All mentions2
- First seenOct 6, 2026
- Last mentioned27d ago
Timeline
2 articles · newest first[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)
Maian Cart 3.8 allows unrestricted banner uploads that become PHP webshells for administrator command execution.
46
Appears with
- Maian Mediaorganization · 1
- 0day Rubbish Research Teamorganization · 1
- Maian Palproduct · 1
- Maian Cartproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.