206 matches found
CVE-2018-14388
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
CVE-2018-14388
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
CVE-2018-14389
Joyplus-cms 1.6.0 is affected by a SQL Injection vulnerability in the manager/admin_ajax.php val parameter. The CVE-2018-14389 entry notes an injection that could impact backend data, with CVSSv3.0 base score 9.8 (CRITICAL) and CVSSv2.0 7.5 (HIGH). Connected records consistently identify joyplus-...
CVE-2018-14389
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14388: Improper Neutralization of Input During Web Page Generation
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...
PT-2018-12483
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to SQL Injection, which can be exploited via the val parameter in the "manager/admin ajax.php" API endpoint. Recommendations For joyplus-cms version 1.6.0, avoid using the val paramete...
PT-2018-12482
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for XSS via the "manager/admin ajax.php" API endpoint, specifically through the can search device array parameter. Recommendations For joyplus-cms version 1.6.0, consider restricting acces...
CVE-2018-14389: Improper Neutralization of Special Elements used in an SQL Command
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14334
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
Design/Logic Flaw
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
CVE-2018-14334
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
CVE-2018-14334
CVE-2018-14334 affects joyplus-cms 1.6.0. The issue is in manager/editor/upload.php, where the check for disallowed file extensions only sets $errm and does not alter control flow, allowing an attacker to upload and execute a PHP file (remote code execution). This is related to the similar CVE-20...
CVE-2018-14334
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
CVE-2018-14334
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
Joyplus CMS Arbitrary File Upload Vulnerability
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A security vulnerability exists in the...
CVE-2018-14334: Unrestricted Upload of File with Dangerous Type
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
PT-2018-12449
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for arbitrary file upload due to insufficient detection of prohibited file extensions in the manager/editor/upload.php file. This can lead to the upload and execution of a .php file...
joyplus-cms cross-site scripting vulnerability (CNVD-2018-13887)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in th...