197 matches found
CVE-2019-16660
CVE-2019-16660 affects joyplus-cms 1.6.0, where the admin_ajax.php?action=savexml&tab=vodplay request is vulnerable to CSRF. The connected records confirm a CSRF flaw but do not provide explicit exploitation steps or a vendor-provided fix within the supplied documents. The CVE entry lists the vul...
PT-2019-14746
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns a CSRF vulnerability in the admin ajax.php endpoint, specifically with the action=savexml and tab=vodplay parameters. This allows for potential unauthorized actions. Recommendations For...
PT-2019-14741
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by accessing the /install API endpoint and placing the malicious code in the name of an object in the database...
CVE-2019-16660: Cross-Site Request Forgery (CSRF)
joyplus-cms 1.6.0 has adminajax.php?action=savexml&tab=vodplay CSRF...
CVE-2019-16656: Undefined Security Weakness
joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database...
CVE-2019-16655: Undefined Security Weakness
joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available...
PT-2019-14740
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for reinstallation if the install/ URI remains available. Recommendations For joyplus-cms version 1.6.0, restrict access to the install/ URI to prevent reinstallation...
Joyplus CMS suffers from an override access vulnerability
Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . An override access vulnerability exists in Joyplu...
joyplus-cms SQL Injection Vulnerability (CNVD-2018-14239)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A SQL injection vulnerability exists in the...
joyplus-cms cross-site scripting vulnerability (CNVD-2018-14238)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...
Sql injection
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
Design/Logic Flaw
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14500
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14501
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14500
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14501
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14501
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14500
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14501
CVE-2018-14501 affects joyplus-cms 1.6.0, where manager/admin_ajax.php is vulnerable to SQL injection via crafted POST data starting with m_id=1 AND SLEEP(5). The vulnerability arises from unsanitized input passed to SQL queries in that endpoint, enabling an attacker to execute arbitrary SQL comm...