CVE-2020-20294

CVE-2020-20294 affects CMSWing 1.3.8. The issue is a log function not validating the log parameter, allowing arbitrary command execution through malicious input. No explicit exploitation details or patch/remediation are provided in the supplied documents.

CMSWing SQL注入漏洞

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A SQL injection vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the rechargeAction function not checking the balance parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands via...

CMSWing SQL注入漏洞

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. CMSWing 1.3.8 suffers from a SQL injection vulnerability. The vulnerability stems from the updateAction function not checking the detail parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands via...

CMSWing SQL注入漏洞

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A code execution vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the log function not checking the log parameter. An attacker can exploit this vulnerability to execute arbitrary commands via malicious parameters...

SQL Injection Vulnerability in CMSWing of Xi'an Huashang Software Technology Co.(CNVD-2020-48681)

CMSWING is a ThinkJS-based e-commerce platform and CMS builder. Xi'an Huashang Software Technology Co., Ltd CMSWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in CMSWing of Xi'an Huashang Software Technology Co.

CMSWING is a ThinkJS-based e-commerce platform and CMS builder. Xi'an Huashang Software Technology Co., Ltd CMSWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in CmsWing

CMSWING is a powerful e-commerce platform and CMS builder based on ThinkJS. CmsWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Stored Cross-Site Scripting Vulnerability in CMSWing v1.3.3

CMSWing is a powerful e-commerce platform and CMS builder based on ThinkJS PC, mobile and WeChat public platform. A stored cross-site scripting vulnerability exists in CMSWing v1.3.3. The vulnerability allows attackers to obtain the administrator's cookie value...

CMSWing Weak Encryption Algorithm Vulnerability

CMSWing is a powerful e-commerce platform and CMS builder based on ThinkJS PC, mobile and WeChat public platform. A weak encryption algorithm vulnerability exists in the global.encryptPassword function of bootstrap/global.js in CMSWing 1.3.7, which can be exploited by an attacker to brute-force...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

Out-of-bounds

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

CMSWing 1.3.7 contains a weakness in global.encryptPassword (bootstrap/global.js) where password hashing relies on multiple MD5 operations. This is documented as a weak‑encryption vulnerability that can be brute‑forced, potentially allowing an attacker to break user passwords. The CVE is corrobor...