CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20600

CVE-2018-20600 affects UCMS 1.4.7 where sadmin\cedit.php is vulnerable to cross-site scripting via the index.php sadmin_cedit action. The vulnerability allows injection of arbitrary web script or HTML, with the CVSS 3.0/2.0 metrics indicating network access, no authentication, user interaction re...

CVE-2018-20601

UCMS 1.4.7 is affected by a Cross‑Site Scripting (XSS) flaw in the description parameter used by the index.php list_editpost action. The root cause, as described across sources, is unescaped or insufficiently sanitized input in the description field that can be reflected in the rendered page. Thi...

CVE-2018-20599

CVE-2018-20599 affects UCMS 1.4.7, where input during the index.php sadmin_fileedit action can be used to execute arbitrary PHP code, enabling remote code execution. The issue is described across multiple sources (NVD/Red Hat/NVD mirror), confirming that the vulnerability stems from the sadmin_fi...

CVE-2018-20597

UCMS 1.4.7 is affected by a cross-site scripting (XSS) vulnerability caused by unsafely handling the dir parameter in the sadmin_fileedit action of index.php. The issue allows injection of arbitrary HTML/JavaScript in user-visible pages. No exploits or practical in-the-wild details are provided i...

PT-2018-15463

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by entering the code during an index.php sadmin fileedit action. Recommendations For UCMS version 1.4.7, consider restricting...

PT-2018-15465

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows for XSS via the description parameter in the "list editpost" action of index.php. Recommendations For version 1.4.7, avoid using the description parameter in the vulnerable index.php list editpos...

CVE-2018-20601: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20597: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20599: Improper Control of Generation of Code

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

PT-2018-15476

Name of the Vulnerable Software and Affected Versions UWA version 2.3.11 Description The issue allows for a CSRF attack via the index.php?g=admin&c=admin&a=add admin do endpoint. Recommendations For version 2.3.11, consider implementing CSRF protection measures, such as token-based validation, to...

CVE-2018-20612: Cross-Site Request Forgery (CSRF)

UWA 2.3.11 allows index.php?g=admin&c=admin&a=addadmindo CSRF...

PT-2018-15464

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs in the sadmincedit.php file of UCMS when an action is performed on index.php, specifically the sadmin cedit action. Recommendations For UCMS...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20568

Administrator/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20569

The CVE-2018-20569 entry applies to the Ivan Cordoba Generic Content Management System (CMS) and concerns a SQL injection vulnerability in the file user/index.php up to 2018-04-28. The root cause is improper input handling in the authentication logic, enabling a bypass of authentication. If explo...

PT-2018-9482

Name of the Vulnerable Software and Affected Versions Battelle V2I Hub version 2.5.1 Description The issue is caused by improper validation of user-supplied input, allowing for cross-site scripting. A remote attacker could exploit this by using the parameterName or login username parameter in a...