Design/Logic Flaw

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

CVE-2018-20598

UCMS 1.4.7 has ?do=useraddpost CSRF...

CVE-2018-20598

CVE-2018-20598 affects UCMS 1.4.7 and is described in connected records as a Cross-Site Request Forgery (CSRF) vulnerability triggered via the parameter ?do=user_addpost. The vulnerability allows an attacker to abuse CSRF to create an administrator account within UCMS. Root cause is CSRF in the u...

CVE-2018-20601

UCMS 1.4.7 is affected by a Cross‑Site Scripting (XSS) flaw in the description parameter used by the index.php list_editpost action. The root cause, as described across sources, is unescaped or insufficiently sanitized input in the description field that can be reflected in the rendered page. Thi...

CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20599

CVE-2018-20599 affects UCMS 1.4.7, where input during the index.php sadmin_fileedit action can be used to execute arbitrary PHP code, enabling remote code execution. The issue is described across multiple sources (NVD/Red Hat/NVD mirror), confirming that the vulnerability stems from the sadmin_fi...

CVE-2018-20597

UCMS 1.4.7 is affected by a cross-site scripting (XSS) vulnerability caused by unsafely handling the dir parameter in the sadmin_fileedit action of index.php. The issue allows injection of arbitrary HTML/JavaScript in user-visible pages. No exploits or practical in-the-wild details are provided i...

CVE-2018-20600

CVE-2018-20600 affects UCMS 1.4.7 where sadmin\cedit.php is vulnerable to cross-site scripting via the index.php sadmin_cedit action. The vulnerability allows injection of arbitrary web script or HTML, with the CVSS 3.0/2.0 metrics indicating network access, no authentication, user interaction re...

CVE-2018-20597: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20599: Improper Control of Generation of Code

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

PT-2018-15461

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue is related to a security problem where an attacker can inject malicious code. This is achieved by exploiting the dir parameter in the "index.php" sadmin fileedit action, allowing for malicious script...

CVE-2018-20601: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20600: Improper Neutralization of Input During Web Page Generation

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

PT-2018-15464

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs in the sadmincedit.php file of UCMS when an action is performed on index.php, specifically the sadmin cedit action. Recommendations For UCMS...

PT-2018-15465

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows for XSS via the description parameter in the "list editpost" action of index.php. Recommendations For version 1.4.7, avoid using the description parameter in the vulnerable index.php list editpos...

PT-2018-15462

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue concerns a CSRF vulnerability in the ?do=user addpost endpoint. Recommendations For UCMS version 1.4.7, consider implementing proper CSRF protection mechanisms to prevent exploitation. As a temporary...

PT-2018-15463

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by entering the code during an index.php sadmin fileedit action. Recommendations For UCMS version 1.4.7, consider restricting...