PT-2018-14857

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered that allows arbitrary directory deletion via directory traversal in the admin/index.php endpoint, specifically through the paths variable. This is possible due to a lack of proper...

PT-2018-14855

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered related to XSS in the template/default/show product.html file. Recommendations For XiaoCms version 20141229, consider restricting access to the template/default/show product.html fil...

PT-2018-14854

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows full path disclosure through the "/admin/index.php?c=database" API endpoint, which returns a "failed to open stream" error message. Recommendations For XiaoCms version 20141229,...

PT-2018-14853

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered that allows for XSS via the largest input box on the "New news" screen. Recommendations For XiaoCms version 20141229, consider restricting access to the "New news" screen until a fix...

PT-2018-14852

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered in XiaoCms, where the API endpoint "admin/index.php?c=content&a=add&catid=3" is vulnerable to CSRF attacks. This can be exploited by entering news via the datacontent parameter...

PT-2018-14856

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue allows remote attackers to execute arbitrary code by bypassing restrictions on uploaded file types, such as jpg, jpeg, bmp, png, and gif, using the type parameter. This can be demonstrated by...

CVE-2018-19194: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

CVE-2018-19193: Improper Neutralization of Input During Web Page Generation

An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen...

CVE-2018-19196: Improper Control of Generation of Code

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types jpg, jpeg, bmp, png, gif, as demonstrated by an...

CVE-2018-19197: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths=../ directory traversal...

CVE-2018-19195: Improper Neutralization of Input During Web Page Generation

An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\showproduct.html file...

CVE-2018-19192: Cross-Site Request Forgery (CSRF)

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

Design/Logic Flaw

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

CVE-2018-14331

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

CVE-2018-14331

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

CVE-2018-14331

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

CVE-2018-14331

The CVE-2018-14331 issue affects XiaoCms X1 v20140305 and is a CSRF vulnerability that allows changing the administrator password via admin/index.php?c=index&a=my. Public records across sources confirm the affected software and the vulnerability class, with CVSS vectors indicating partial confide...

CVE-2018-14331: Cross-Site Request Forgery (CSRF)

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

PT-2018-12446

Name of the Vulnerable Software and Affected Versions XiaoCms X1 version v20140305 Description An issue was discovered that allows for a CSRF vulnerability, enabling an attacker to change the administrator account password via the "admin/index.php?c=index&a=my" API endpoint. Recommendations For...

File upload vulnerability in XiaoCms Enterprise Website Edition (XiaoCms企业建站版)

Based on PHP+Mysql architecture, XiaoCms Enterprise Builder is a small, flexible, simple and easy-to-use lightweight cms. XiaoCms Enterprise Website Builder has a file upload vulnerability that can be exploited by attackers to upload malicious scripts to gain administrator privileges...