CVE-2018-19222

The CVE-2018-19222 entry concerns LAOBANCMS 2.0, where an attacker can trigger an administrator password reset via the path /install/mysql_hy.php?riqi=0&i=0, even if install.txt exists. The issue is described across multiple sources (Red Hat, CNVD, NVD, CVE listings) as a password-reset vulnerabi...

CVE-2018-19220

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI...

CVE-2018-19228

An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation...

CVE-2018-19224

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

CVE-2018-19221

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

CVE-2018-19227

An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong parameter...

CVE-2018-19225

An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF...

CVE-2018-19222

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysqlhy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists...

CVE-2018-19229

LAOBANCMS 2.0 is affected by an XSS vulnerability in the admin/art.php?typeid=1 biaoti parameter. Multiple connected sources (NVD/NVD-derived CVE, Red Hat, CNVD, CVE listings) corroborate that the issue arises from unsanitized input in the biaoti parameter leading to cross-site scripting. The exa...

CVE-2018-19220

LAOBANCMS 2.0 is affected by an arbitrary PHP code execution flaw that can be triggered by the host parameter to the install/ URI. The issue is remote, unauthenticated, and exploitable over network with the potential for high impact (per CVSSv3.0: CRITICAL, 9.8; Confidentiality/Integrity/Availabi...

CVE-2018-19227

LAOBANCMS 2.0 shows a cross-site scripting vulnerability via the admin/liuyan.php neirong[] parameter. Affected component is the LAOBANCMS content management system; root cause is inadequate input sanitization leading to XSS. CVSS v3 base score 5.4 (MEDIUM) with network access, low privileges, us...

CVE-2018-19228

Summary: CVE-2018-19228 affects LAOBANCMS 2.0 and involves an arbitrary file deletion vulnerability triggered by directory traversal in the admin/pic.php del parameter. Evidence shows an attacker can delete files (e.g., install/install.txt) by traversing ../, enabling a reinstallation path. The a...

CVE-2018-19226

CVE-2018-19226 concerns LAOBANCMS 2.0, where an information disclosure vulnerability allows remote attackers to list the contents of .txt files by issuing a direct request to the URI /data/0/admin.txt. The vulnerability is described as an ability to enumerate or reveal text file listings, indicat...

CVE-2018-19224

LAOBANCMS 2.0 contains a vulnerability in /admin/login.php that allows spoofing of the id and guanliyuan cookies. The records (CVE-2018-19224) confirm this issue but do not provide the underlying technical flaw, affected versions beyond 2.0, specific exploit details, or remediation guidance in th...

CVE-2018-19226

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI...

CVE-2018-19223

An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI...

CVE-2018-19229

An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter...

CVE-2018-19223

CVE-2018-19223 affects LAOBANCMS 2.0 (PHP + MySQL). The issue is a cross-site scripting (XSS) vulnerability accessible via the first input field of the URL admin/type.php?id=1, suggesting insufficient input validation. Notes from connected sources confirm the same description across multiple reco...

CVE-2018-19221

CVE-2018-19221 affects LAOBANCMS 2.0. The vulnerability is a SQL injection via the admin/login.php guanliyuan parameter, as described across multiple connected sources. CVSS metrics from the initial document show an overall high/critical impact (CVSS2: 7.5; CVSS3: 9.8) with network access, no aut...