PT-2021-10474

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8 Description: An issue was found in the CMSWing project where the log function does not check the log parameter, allowing malicious parameters to execute arbitrary commands. Recommendations: For CMSWing version 1.3.8,...

CVE-2020-20295: Improper Neutralization of Special Elements used in an SQL Command

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

PT-2021-10476

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8 Description: An issue was found in the CMSWing project where the rechargeAction function does not check the balance parameter, allowing malicious parameters to execute arbitrary SQL commands. Recommendations: For CMSWing...

PT-2021-10475

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8 Description: An issue was found in the CMSWing project where the updateAction function does not check the detail parameter, allowing malicious parameters to execute arbitrary SQL commands. Recommendations: For CMSWing...

SQL Injection Vulnerability in CMSWing of Xi'an Huashang Software Technology Co.(CNVD-2020-48681)

CMSWING is a ThinkJS-based e-commerce platform and CMS builder. Xi'an Huashang Software Technology Co., Ltd CMSWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in CMSWing of Xi'an Huashang Software Technology Co.

CMSWING is a ThinkJS-based e-commerce platform and CMS builder. Xi'an Huashang Software Technology Co., Ltd CMSWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in CmsWing

CMSWING is a powerful e-commerce platform and CMS builder based on ThinkJS. CmsWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Stored Cross-Site Scripting Vulnerability in CMSWing v1.3.3

CMSWing is a powerful e-commerce platform and CMS builder based on ThinkJS PC, mobile and WeChat public platform. A stored cross-site scripting vulnerability exists in CMSWing v1.3.3. The vulnerability allows attackers to obtain the administrator's cookie value...

CMSWing Weak Encryption Algorithm Vulnerability

CMSWing is a powerful e-commerce platform and CMS builder based on ThinkJS PC, mobile and WeChat public platform. A weak encryption algorithm vulnerability exists in the global.encryptPassword function of bootstrap/global.js in CMSWing 1.3.7, which can be exploited by an attacker to brute-force...

Out-of-bounds

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

CMSWing 1.3.7 contains a weakness in global.encryptPassword (bootstrap/global.js) where password hashing relies on multiple MD5 operations. This is documented as a weak‑encryption vulnerability that can be brute‑forced, potentially allowing an attacker to break user passwords. The CVE is corrobor...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

CVE-2019-7649

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...

PT-2019-18681

Name of the Vulnerable Software and Affected Versions CMSWing version 1.3.7 Description The issue concerns the password hashing mechanism in CMSWing, where the global.encryptPassword function in bootstrap/global.js relies on multiple MD5 operations. This could potentially lead to security...

CVE-2019-7649: Use of Password Hash With Insufficient Computational Effort

global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...