Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
MojoPortal CMS allows attackers to run malicious commands via zip file
CVE-2025-69770
Summary
MojoPortal CMS v2.9.0.1 has a security issue where attackers can upload a special zip file to the /DesignTools/SkinList.aspx endpoint, allowing them to execute commands on the server. This could lead to unauthorized access, data theft, or even server takeover. Update to the latest version of MojoPortal to fix this issue.
Original title
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.
Original description
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.
nvd CVSS3.1
10.0
Vulnerability type
CWE-22
Path Traversal
Published: 13 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026