CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

CVE-2019-14976

CVE-2019-14976 affects iCMS 7.0.15, exposing a cross-site scripting (XSS) vulnerability in the admin panel. The issue arises via the keywords parameter in admincp.php?app=apps, enabling potentially injection of malicious client-side script. Multiple connected sources (NVD/NIST entries and Red Hat...

CVE-2019-14976: Improper Neutralization of Input During Web Page Generation

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

Cross site request forgery (csrf)

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

CVE-2019-1010112

OECMS v4.3.R60321 and later is affected by a Cross Site Request Forgery (CSRF) vulnerability in admincp.php. The attack vector is network connectivity, and the impact is that a victim could be tricked into adding an administrator account. The fixed version is v4.3. This CVE entry corresponds to C...

CVE-2019-1010112: Cross-Site Request Forgery (CSRF)

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

CVE-2019-11426: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

CVE-2019-7234

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...

Directory traversal

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...

Directory traversal

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request...

CVE-2019-7235

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request...

CVE-2019-7234

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...

CVE-2019-7235

The CVE-2019-7235 entry concerns idreamsoft iCMS 7.0.13. A directory traversal flaw exists in admincp.php?app=apps&do=save that can be triggered through _app=/../ to designate an arbitrary directory; this path can then be deleted via an admincp.php?app=apps&do=uninstall request. The connected doc...

CVE-2019-7237: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\ Directory Traversal...

CVE-2019-7236: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal...

CVE-2019-7235: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request...

CVE-2019-7234: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...

CVE-2019-7160: Improper Limitation of a Pathname to a Restricted Directory

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...