197 matches found
CVE-2018-14500
Joyplus-cms 1.6.0 contains a cross-site scripting (XSS) vulnerability in the writer/collect_vod_zhuiju.php endpoint where the keyword parameter can be injected with arbitrary script/HTML. Public disclosures across CVE/NVD/CNVD confirm XSS via the manager/collect/collect_vod_zhuiju.php keyword par...
CVE-2018-14501: Improper Neutralization of Special Elements used in an SQL Command
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14500: Improper Neutralization of Input During Web Page Generation
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
PT-2018-12550
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the keyword parameter in the "manager/collect/collect vod zhuiju.php" endpoint. Recommendations For joyplus-cms version 1.6.0, avoi...
PT-2018-12551
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns SQL Injection in the manager/admin ajax.php file. This can be exploited by sending crafted POST data, for example, a substring like "m id=1 AND SLEEP5". Recommendations For joyplus-cms...
joyplus-cms cross-site scripting vulnerability (CNVD-2018-17480)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...
joyplus-cms SQL Injection Vulnerability
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A SQL injection vulnerability exists in joyplus-c...
CVE-2018-14389
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
Design/Logic Flaw
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
Sql injection
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14388
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
CVE-2018-14389
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14388
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
CVE-2018-14389
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14388
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
CVE-2018-14389
Joyplus-cms 1.6.0 is affected by a SQL Injection vulnerability in the manager/admin_ajax.php val parameter. The CVE-2018-14389 entry notes an injection that could impact backend data, with CVSSv3.0 base score 9.8 (CRITICAL) and CVSSv2.0 7.5 (HIGH). Connected records consistently identify joyplus-...
CVE-2018-14389
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14388
Joyplus-cms 1.6.0 is vulnerable to cross-site scripting (XSS) via the can_search_device parameter sent to manager/admin_ajax.php. The root cause is unsanitized user input in that parameter, allowing arbitrary script execution in a user’s browser. Multiple sources (NVD, Red Hat, CNVD, CNVD, PRION,...