Synaptik Cms
Monthly
Authenticated attackers with admin-level access to Synaptik CMS (synaptik-cms) through version 1.3.4.4 can abuse the rename function in admin/file-manager.php to place executable files on the server, bypassing the intended file-type restrictions. Exploitation is remote and requires only administrative privileges (PR:H, UI:N), with limited confidentiality, integrity, and availability impact per the CVSS 4.0 vector scoring 5.1; publicly available exploit code has been published in a GitHub security-research repository, so weaponized use against unpatched instances is plausible. The vendor has released version 1.3.5, which remediates the issue, and no CISA KEV listing or EPSS score was supplied in the source data.
Authenticated attackers with admin-level access to Synaptik CMS (synaptik-cms) through version 1.3.4.4 can abuse the rename function in admin/file-manager.php to place executable files on the server, bypassing the intended file-type restrictions. Exploitation is remote and requires only administrative privileges (PR:H, UI:N), with limited confidentiality, integrity, and availability impact per the CVSS 4.0 vector scoring 5.1; publicly available exploit code has been published in a GitHub security-research repository, so weaponized use against unpatched instances is plausible. The vendor has released version 1.3.5, which remediates the issue, and no CISA KEV listing or EPSS score was supplied in the source data.