80 matches found
CVE-2018-13025
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...
Yxcms Cross-Site Request Forgery Vulnerability
Yxcms is an efficient, flexible, practical and free enterprise building system, based on PHP and mysql technology. YXcms 1.4.7 in the protected/apps/admin/controller/adminController.php cross-site request forgery vulnerability. A remote attacker can exploit this vulnerability by deleting the...
CVE-2018-11003
An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...
Cross site request forgery (csrf)
An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...
CVE-2018-11003
An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...
CVE-2018-11003
YXcms 1.4.7 suffers a CSRF vulnerability in protected/apps/admin/controller/adminController.php that allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel. The issue’s impact is that an unauthenticated attacker can trigger account deletions, as described in...
CVE-2018-11003
An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...
Cross-site Scripting Vulnerability in YXcms
YXCMS is an efficient website management system built on PHP+MYSQL. A cross-site scripting vulnerability exists in YXcms version 1.4.7. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...
Stored Cross-site Scripting and SQL Injection Vulnerabilities in YXcms Backend Membership Management System
YXCMS is an efficient website management system built on PHP+MYSQL. A stored cross-site scripting and SQL injection vulnerability exists in the YXcms backend member management system. An attacker can exploit the vulnerabilities to obtain information such as database information and user cookies,...
YXcms backend has multiple SQL injection vulnerabilities
Yxcms is an enterprise building system based on PHP and mysql technology. YXcms V1.4.7 SQL injection vulnerability exists in the background label management and link management. The vulnerability stems from the program does not effectively filter the parameters, the attacker can use the...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
Design/Logic Flaw
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805
CVE-2018-8805 affects Yxcms building system (compatible cell phone) v1.4.7. A cross-site scripting (XSS) vulnerability exists via the content parameter in protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php when requested through ind...
Yxcms Logic Flaw Vulnerability
Yxcms building system compatible cell phone is a website creation system. A security vulnerability exists in the protected\apps\member\controller\shopcarController.php file in version 1.4.7 of the Yxcms building system compatible cell phone. The vulnerability can be exploited by an attacker to...
Yxcms Cross-Site Scripting Vulnerability
Yxcms building system compatible cell phone is a website creation system. A cross-site scripting vulnerability exists in version 1.4.7 of the Yxcms building system compatible cell phone. A remote attacker can create a cross-site scripting vulnerability by making a request to...