Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the adminlang cookie to admin/functions.php or (2) read arbitrary local files via the img parameter to admin/show_img.php.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| E-vision_cms | E-vision | * | 2.02 (including) |