Badaso Core vulnerabilities

CVE-2025-52353 [HIGH] CWE-434 Badaso CMS file upload vulnerability Badaso CMS file upload vulnerability An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlyi

CVE-2022-41705 [CRITICAL] CWE-434 Badaso vulnerable to Remote Code Execution (RCE) Badaso vulnerable to Remote Code Execution (RCE) Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

CVE-2022-41711 [CRITICAL] CWE-434 Badaso vulnerable to Remote Code Execution via malicious file upload Badaso vulnerable to Remote Code Execution via malicious file upload Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.