CVE-2019-9623

Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!–#exec cmd=" in a .shtml file to ck_upload_handler.php.

Source: CVE-2019-9623