[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H

[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)

Reported by Full Disclosure

Summary by Cyber Security News15 Oct 2026, 09:42 CET

About this summary. This is a short excerpt from the description that Full Disclosure published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/fulldisclosure/2026/Oct/17

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom), oriented at PayPal checkout and distributed as a commercial closed-source archive, verified end to end against a real installation of that version in three independent reproductions.

Read the full article at Full Disclosure →

Source attribution: headline and facts are from Full Disclosure (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.