Cayin Cms Se
Monthly
Arbitrary file upload leading to remote code execution affects CAYIN Technology's CMS-WS, CMS-SE, and SMP series digital signage management platforms. Privileged remote attackers can upload web shells through the product's file upload functionality and then execute arbitrary commands on the underlying server. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no active exploitation; however, the technical impact is rated total across confidentiality, integrity, and availability.
Missing authentication on a specific API endpoint in CAYIN CMS-WS and CMS-SE allows unauthenticated remote attackers to retrieve media file lists, resulting in partial information disclosure. All versions of both products are affected per CPE data, and the vulnerability requires no credentials, no user interaction, and no special network position - only HTTP reachability to the CMS instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and the confidentiality impact is limited to media asset enumeration rather than credential or configuration exposure.
Arbitrary file upload leading to remote code execution affects CAYIN Technology's CMS-WS, CMS-SE, and SMP series digital signage management platforms. Privileged remote attackers can upload web shells through the product's file upload functionality and then execute arbitrary commands on the underlying server. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no active exploitation; however, the technical impact is rated total across confidentiality, integrity, and availability.
Missing authentication on a specific API endpoint in CAYIN CMS-WS and CMS-SE allows unauthenticated remote attackers to retrieve media file lists, resulting in partial information disclosure. All versions of both products are affected per CPE data, and the vulnerability requires no credentials, no user interaction, and no special network position - only HTTP reachability to the CMS instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and the confidentiality impact is limited to media asset enumeration rather than credential or configuration exposure.