77 matches found
CVE-2018-12944
SeedDMS (formerly LetoDMS/MyDMS) is affected by a persistent XSS in the Categories feature. The vulnerability is in the name field and affects SeedDMS versions prior to 5.1.8. Exploitation details are not provided in the available documents.
CVE-2018-12942
SeedDMS (formerly LetoDMS/MyDMS) contains a SQL injection vulnerability in the Users management feature affecting versions before 5.1.8 . The flaw allows authenticated attackers to manipulate SQL queries on the application server, enabling extraction, modification, or deletion of data in the back...
CVE-2018-12941
SeedDMS is affected by a remote code execution/command injection vulnerability (CVE-2018-12941) prior to version 5.1.8. An authenticated user with Settings permissions can manipulate the Cache directory path (cacheDir) to inject arbitrary system commands via the Clear Cache workflow, enabling exe...
CVE-2018-12940
SeedDMS before 5.1.8 has an unrestricted file upload in the file op/op.UploadChunks.php (parameter qqfile ). An authenticated attacker can upload a file with an executable extension, upload a malicious PHP payload, and execute OS commands from the web root. This vulnerability is documented as CVE...
CVE-2018-12943
SeedDMS before 5.1.8 contains a cross-site scripting (XSS) vulnerability via the action URL parameter on every page that includes it, allowing remote attackers to inject arbitrary script or HTML. The issue is described consistently across multiple sources (NVD/CNVD), with the affected version ran...
CVE-2018-12939
A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...
LetoDMS suffers from multiple cross-site scripting vulnerabilities (CNVD-2017-35521)
LetoDMS formerly known as MyDMS is a set of PHP and MySQL development of Web-based open source document management system . Multiple cross-site scripting vulnerabilities exist in versions of LetoDMS prior to 3.3.8. Remote attackers can use the parameters in the inc/inc.ClassUI.php or...
LetoDMS SQL Injection Vulnerability (CNVD-2017-35203)
LetoDMS is a document management system based on PHP+MySQL development. A SQL injection vulnerability exists in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS before version 3.3.8, which can be exploited by remote attackers to execute arbitrary SQL commands...
LetoDMS Cross-Site Request Forgery Vulnerability
LetoDMS is a document management system based on PHP+MySQL development. A cross-site request forgery vulnerability exists in LetoDMS versions prior to 3.3.8, which can be exploited by remote attackers to hijack a victim's authentication...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...
CVE-2012-4567
Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...
CVE-2012-4570
SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2012-4569
Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
DEBIAN-CVE-2012-4570
SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
Sql injection
SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2012-4567
Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-4569
Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...