CVE-2018-20567

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

CVE-2018-20563

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobilename parameter...

CVE-2018-20562

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/articlecategory.php?rec=update has XSS via the catname parameter...

CVE-2018-20566

CVE-2018-20566 affects DouCo DouPHP 1.5 20181221. A crafted installation page can trigger a Smarty error: unable to read resource, leading to full path disclosure. The issue is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists) with the same symptom, but the provided documents do ...

CVE-2018-20565

DouCo DouPHP 1.5 (20181221) is affected by a Cross-Site Scripting (XSS) in admin/nav.php?rec=update via the nav_name parameter. The vulnerability could allow injection of arbitrary web script or HTML in the admin context. No exploit details or definitive remediation are provided in the connected ...

CVE-2018-20560

The CVE-2018-20560 entry concerns DouCo DouPHP 1.5 (build 20181221). The vulnerability is a Cross-Site Scripting (XSS) flaw in admin/show.php?rec=update, exploitable via the show_name parameter. The Red Hat/CNVD/CVE cross-referenced entries corroborate the same issue. The available sources do not...

CVE-2018-20565

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the navname parameter...

CVE-2018-20561

CVE-2018-20561 affects DouCo DouPHP 1.5 20181221. The vulnerability is a stored/reflected XSS in admin/article.php?rec=update via the title parameter, enabling injection of arbitrary script/HTML as described in multiple sources. Affected component is the admin interface (article update logic) and...

CVE-2018-20557

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...

CVE-2018-20558

CVE-2018-20558 affects DouCo DouPHP 1.5 (20181221). The vulnerability is a Cross-Site Scripting (XSS) flaw in admin/system.php?rec=update, exploitable via the site_name parameter . This could allow an attacker to inject arbitrary web script/HTML that is rendered by a user’s browser; CVSS scores i...

CVE-2018-20559

The CVE-2018-20559 entry affects DouCo DouPHP 1.5 (build 20181221). The vulnerability is an XSS flaw in admin/product.php?rec=update that is exploitable via the name parameter, enabling injection of arbitrary script/HTML. Underlying cause: insufficient input sanitization on the name field. Docume...

Cross site request forgery (csrf)

DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account...

CVE-2018-20419

DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account...

CVE-2018-20419

CVE-2018-20419 affects DouCo DouPHP 1.5. The flaw arises from a CSRF in the upload/admin/manager.php?rec=insert endpoint, which can be used to incrementally add an administrator account. According to the NVD entry, the vulnerability has a CMS-level impact across confidentiality, integrity, and av...