PT-2018-12482

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for XSS via the "manager/admin ajax.php" API endpoint, specifically through the can search device array parameter. Recommendations For joyplus-cms version 1.6.0, consider restricting acces...

PT-2018-12483

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to SQL Injection, which can be exploited via the val parameter in the "manager/admin ajax.php" API endpoint. Recommendations For joyplus-cms version 1.6.0, avoid using the val paramete...

Design/Logic Flaw

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...

CVE-2018-14334

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...

CVE-2018-14334

CVE-2018-14334 affects joyplus-cms 1.6.0. The issue is in manager/editor/upload.php, where the check for disallowed file extensions only sets $errm and does not alter control flow, allowing an attacker to upload and execute a PHP file (remote code execution). This is related to the similar CVE-20...

CVE-2018-14334

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...

CVE-2018-14334

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...

CVE-2018-14334: Unrestricted Upload of File with Dangerous Type

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...

PT-2018-12449

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for arbitrary file upload due to insufficient detection of prohibited file extensions in the manager/editor/upload.php file. This can lead to the upload and execution of a .php file...

Joyplus CMS Arbitrary File Upload Vulnerability

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A security vulnerability exists in the...

joyplus-cms cross-site scripting vulnerability (CNVD-2018-13887)

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in th...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

Joyplus-CMS 1.6.0 contains a cross-site scripting (XSS) vulnerability in admin_player.php, related to manager/index.php “system manage” and “add” actions. Multiple sources (NVD, Red Hat, CNVD, CNVD CNVD, CVE lists) confirm the same issue; root cause described as XSS in the admin interface. Exploi...

PT-2018-11463

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to an XSS in the admin player.php file, specifically with the "system manage" and "add" actions in the manager/index.php file. Recommendations For joyplus-cms version 1.6.0, consider...

CVE-2018-12905: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

Remote Code Execution Vulnerability in joyplus-cms manager/index.php File

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A security vulnerability exists in the...