CVE-2018-19181

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file...

CVE-2018-19180

statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...

CVE-2018-19181

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file...

CVE-2018-19180

statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...

CVE-2018-19180

CVE-2018-19180 affects YUNUCMS 1.1.5. The issue exists in statics/app/index/controller/Install.php (when install.lock is absent) where an attacker can inject arbitrary PHP code through the DB_PREFIX field, which is written to database.php, enabling remote code execution. Multiple connected source...

CVE-2018-19181

The CVE affects YUNUCMS 1.1.5, where statics/ueditor/php/vendor/Local.class.php is exploitable through statics/ueditor/php/controller.php?action=remove with a directory-traversal path. This allows arbitrary file deletion (demonstrated by deleting install.lock). Root cause is a vulnerable remove a...

CVE-2018-19181

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file...

SQL Injection Vulnerability in My***.php File of YunYu CMS Enterprise Website Management System

YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. A SQL injection vulnerability exists in the My.php file of YUNUCMS enterprise website management system. An attacker can exploit the...

CVE-2018-18726

An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5...

CVE-2018-18726

An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5...

CVE-2018-18724

An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5...

CVE-2018-18724

An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5...

CVE-2018-18725

An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5...

CVE-2018-18723

An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5...

CVE-2018-18723

An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5...

CVE-2018-18720

An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5...

CVE-2018-18722

An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5...

CVE-2018-18721

An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5...

CVE-2018-18722

An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5...

CVE-2018-18721

An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5...