Total vulnerabilities in the database
ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.
| Software | From | Fixed in |
|---|---|---|
| expressionengine / expressionengine | 6.0.0 | 6.0.3 |
| expressionengine / expressionengine | - | 5.4.2 |