CVE-2021-27230

ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an…

published March 15, 2021

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02832 · 86.5th percentile
Published
2021-03-15T22:52Z
EPSS history
Timeline
  • 15 MAR 22:52Z
    ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an…
    cvelistv5