CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

Sql injection

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039

Joyplus-CMS version 1.6.0 is affected by a Remote Code Execution vulnerability in manager/index.php caused by an Arbitrary SQL command execution issue that relies on using a "/!select/" substring in place of a select substring. This is documented across multiple sources (NVD/Red Hat/CNVD) and ind...

PT-2018-10960

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for Remote Code Execution due to an Arbitrary SQL command execution problem. This is caused by the use of a "/!select/" substring in place of a select substring in the manager/index.php...

CVE-2018-12039: Improper Neutralization of Special Elements used in an SQL Command

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

Cross site request forgery (csrf)

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096

Joyplus-cms 1.6.0 is affected by a cross-site scripting (XSS) vulnerability exploitable through the device_name parameter in manager/admin_ajax.php?action=save flag=add. The root cause is likely inadequate input sanitization of device_name, allowing injected scripts to be reflected in the applica...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

PT-2018-9677

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a Cross-Site Scripting XSS problem. It is exploited through the device name parameter in a "manager/admin ajax.php?action=save flag=add" request, specifically the "/manager/admin...

joyplus-cms cross-site scripting vulnerability (CNVD-2018-08675)

joyplus-cms is an efficient video movie website management system built with PHPmysql. A cross-site scripting vulnerability exists in manager/adminvod.php in joyplus-cms 1.6.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the keyword parameter...

CVE-2018-10073

joyplus-cms 1.6.0 has XSS in manager/adminvod.php via the keyword parameter...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in manager/adminvod.php via the keyword parameter...

CVE-2018-10073

joyplus-cms 1.6.0 has XSS in manager/adminvod.php via the keyword parameter...

CVE-2018-10073

joyplus-cms 1.6.0 has XSS in manager/adminvod.php via the keyword parameter...

CVE-2018-10073

The CVE-2018-10073 entry applies to joyplus-cms 1.6.0, where a cross-site scripting vulnerability exists in manager/admin_vod.php via the keyword parameter. Root cause is improper handling of the keyword input leading to XSS. Documents state the affected software and vulnerable parameter but do n...