Cross site scripting

Qibosoft v7 contains a stored cross-site scripting XSS vulnerability in the component /admin/index.php?lfj=friendlink&action=add...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL...

CVE-2020-20946

Qibosoft v7 contains a stored cross-site scripting XSS vulnerability in the component /admin/index.php?lfj=friendlink&action=add...

CVE-2020-20946

CVE-2020-20946 affects Qibosoft v7 (CMS) with a stored XSS vulnerability in the admin path /admin/index.php?lfj=friendlink&action=add. The root cause is input data not validated in the friendlink/add handler, enabling injected client-side script execution. CVSS metrics indicate a Low to Medium ov...

CVE-2020-20945

A Cross-Site Request Forgery CSRF in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts...

CVE-2020-20944

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...

CVE-2020-20945

CVE-2020-20945 is a CSRF vulnerability in Qibosoft v7 affecting the endpoint /admin/index.php?lfj=member&action=editmember, which allows an attacker to arbitrarily add administrator accounts. The connected records confirm the affected product (Qibosoft v7 CMS), the vulnerable function/URL, and th...

CVE-2020-20944

Qibosoft v7 is affected by an arbitrary file deletion vulnerability via /admin/index.php?lfj=mysql&action=del. The root cause is the action=del parameter enabling deletion, as described in PT-2021-10556. Impact: potential unauthorized file removal. Remediation: restrict access to the /admin/index...

CVE-2020-20943

A Cross-Site Request Forgery CSRF in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL...

CVE-2020-20943

CVE-2020-20943 affects Qibosoft v7 (CMS). A CSRF flaw in the endpoint /member/post.php?job=postnew&step=post allows an attacker to coerce victims into arbitrarily publishing new articles via a crafted URL. The available connected documents confirm the vulnerability’ s existence and the affected c...

Qibosoft qibosoft 跨站请求伪造漏洞

Qibosoft qibosoft is a content management system CMS from Qibosoft China. qibosoft suffers from a cross-site request forgery vulnerability, which can be exploited by attackers to publish malicious articles...

Qibosoft 跨站脚本漏洞

Qibosoft qibosoft is a content management system CMS from Qibosoft, China. qibosoft has a cross-site scripting vulnerability that originates in the /admin/index.php?lfj=friendlink & action=add link of the admin component of the product. The vulnerability is caused by the...

Qibosoft qibosoft 路径遍历漏洞

Qibosoft qibosoft is a content management system CMS from Qibosoft, a Chinese company. qibosoft is vulnerable to licensing issues, which can be exploited by attackers to arbitrarily delete files...

PT-2021-10556 · Qibosoft · Qibosoft

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: The issue allows attackers to arbitrarily delete files through the /admin/index.php?lfj=mysql&action=del endpoint. The action parameter is used with the value del to perform the deletion. Recommendations: For...

Qibosoft 跨站请求伪造漏洞

Qibosoft qibosoft is a content management system CMS from Qibosoft, a Chinese company. qibosoft is vulnerable to cross-site request forgery, which can be exploited by attackers to arbitrarily add administrator accounts...

CVE-2020-18022

Cross Site Scripting XSS in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component...

CVE-2020-18022

CVE-2020-18022 affects Qibosoft QiboCMS v7 and earlier via a flaw in the embedded editor component (ewebeditor 3.1.1 / kindeditor.js). The vulnerability allows remote attackers to inject commands through HTTP requests, enabling Cross Site Scripting (XSS) that can lead to arbitrary code execution ...

Qibosoft QiboCMS 跨站脚本漏洞

Qibo QiboCMS is a software application of China Qibo Qibo company. A website building CMS. A cross-site scripting vulnerability exists in Qibosoft QiboCMS v7 and earlier versions, which allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary comman...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...