CVE-2019-6779

Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...

CVE-2018-17125

CScms 4.1 allows arbitrary directory deletion via a dir=..\ substring to plugins\sys\admin\Plugins.php...

CVE-2018-17126

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

Remote code execution

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

CVE-2018-17126

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

Arbitrary file deletion

CScms 4.1 allows arbitrary directory deletion via a dir=..\ substring to plugins\sys\admin\Plugins.php...

CVE-2018-17125

CVE-2018-17125 affects CScms 4.1. The vulnerability is an arbitrary directory deletion flaw in the plugins/sys/admin/Plugins.php handler, triggered by a dir=..\ substring that allows deleting arbitrary directories. This is due to insufficient input validation of the dir parameter, enabling path t...

CVE-2018-17125

CScms 4.1 allows arbitrary directory deletion via a dir=..\ substring to plugins\sys\admin\Plugins.php...

CVE-2018-17126

CVE-2018-17126 affects CScms 4.1. The vulnerability is a remote code execution through a crafted input in Web Name to upload\plugins\sys\Install.php, leveraging 1');eval($_POST[cmd]);# in the Install.php file. This indicates an unauthenticated remote command execution path via user-supplied POST ...

CVE-2018-17126

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

CScms Arbitrary Directory Deletion Vulnerability

CScms is a content management system CMS developed on a CI framework. An arbitrary directory deletion vulnerability exists in CScms version 4.1. An attacker can delete arbitrary directories by sending a dir=... to the plugins\sys\admin\Plugins.php page. \\ sub-string to the...

CScms Remote Code Execution Vulnerability

CScms is a content management system CMS developed on a CI framework. A security vulnerability exists in CScms version 4.1. A remote attacker can exploit the vulnerability to execute code...

CScms Cross-Site Scripting Vulnerability

CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the \upload\plugins\sys\Install.php file in CScms version 4.1. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML by using the site name...

Cross site request forgery (csrf)

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16732

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

Cross site scripting

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

Default credentials

CScms 4.1 allows arbitrary file upload by for example adding the php extension to the default filetype list gif, jpg, png, and then providing a .php pathname within fileurl JSON data...

CVE-2018-16731

CVE-2018-16731 affects CScms 4.1 and is described as an arbitrary file upload vulnerability: an attacker can add the php extension to the allowed filetype list and supply a .php pathname inside the fileurl JSON data to obtain uploaded PHP code. The connected records confirm the issue and provide ...