Jtbc5 Cms
Monthly
Path traversal in Qihui jtbc5 CMS 5.0.3.6 allows authenticated remote attackers to read arbitrary files via a manipulated path parameter in /dev/code/common/diplomat/manage.php. The vulnerability has a published exploit and affects the Code Endpoint component; the vendor has not responded to early disclosure. With CVSS 4.3 and EPSS probability marked as Proof-of-Concept, this represents a moderate confidentiality risk limited to authenticated users.
Path traversal in Qihui jtbc5 CMS 5.0.3.6 allows authenticated remote attackers to read arbitrary files via a manipulated path parameter in /dev/code/common/diplomat/manage.php. The vulnerability has a published exploit and affects the Code Endpoint component; the vendor has not responded to early disclosure. With CVSS 4.3 and EPSS probability marked as Proof-of-Concept, this represents a moderate confidentiality risk limited to authenticated users.