CVE-2016-10751

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-24 · updated 2026-06-17
Weakness: CWE-22

Description

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.

Affected products

Osclass: 3.6.1

References

https://blog.ripstech.com/2016/osclass-remote-code-execution-via-image-file/
https://demo.ripstech.com/projects/osclass_3.6.1
https://blog.ripstech.com/2016/osclass-remote-code-execution-via-image-file/
https://demo.ripstech.com/projects/osclass_3.6.1

Get alerted when CVE-2016-10751 or the next vulnerability affects your stack