CVE-2018-8805

Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...

Yxcms Logic Flaw Vulnerability

Yxcms building system compatible cell phone is a website creation system. A security vulnerability exists in the protected\apps\member\controller\shopcarController.php file in version 1.4.7 of the Yxcms building system compatible cell phone. The vulnerability can be exploited by an attacker to...

Yxcms Cross-Site Scripting Vulnerability

Yxcms building system compatible cell phone is a website creation system. A cross-site scripting vulnerability exists in version 1.4.7 of the Yxcms building system compatible cell phone. A remote attacker can create a cross-site scripting vulnerability by making a request to...

CVE-2018-8805: Improper Neutralization of Input During Web Page Generation

Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...

CVE-2018-8761

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

Design/Logic Flaw

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

CVE-2018-8761

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

CVE-2018-8761

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

CVE-2018-8761

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

CVE-2018-8761

CVE-2018-8761 : In Yxcms building system (compatible cell phone) v1.4.7, a logic flaw in the file protected\apps\member\controller\shopcarController.php allows an attacker to modify a price before form submission by observing data in a packet capture. The vulnerability is described in multiple so...

CVE-2018-8761: Undefined Security Weakness

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

Yxcms Arbitrary File Deletion Vulnerability

Yxcms is an enterprise building system based on PHP and mysql technology. Yxcms 1.4.6 version exists arbitrary file deletion vulnerability, attackers can use the vulnerability to delete files arbitrarily...

YXCMS backend new template with SQL execution function has arbitrary file write vulnerability

Yxcms is an enterprise building system based on PHP and mysql technology. YXCMS backend new templates and SQL execution function has arbitrary file write vulnerability, attackers can exploit the vulnerability to write webshell, get server privileges...

YxcmsAPP V1.4.3 Stored Cross-site Scripting Vulnerability at Frontend Guestbook

Yxcms is an enterprise building system based on PHP and mysql technology. YxcmsAPP V1.4.3 stored cross-site scripting vulnerability in the front-end guestbook. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...

Multiple vulnerabilities in YXCMS frontend

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. YXCMS front-end cross-site scripting and cross-site request forgery vulnerabilities. htmlin function is not strict on xss filtering does not take into account the pseudo-protocol , due to the failure to...

YXcms photoController.php SQL Injection Vulnerability

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. A SQL injection vulnerability exists in YXcms photoController.php. Allow attackers to exploit the vulnerability to obtain sensitive database information...

YXcms newsController.php SQL Injection Vulnerability

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. A SQL injection vulnerability exists in YXcms newsController.php. Allow attackers to exploit the vulnerability to obtain sensitive database information...

Cross-site scripting vulnerability in yxcms Referer parameter

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. A cross-site scripting vulnerability exists in the Referer parameter on the yxcms\protected\apps\member\controller\indexController.php page in yxcms V1.4. Because the program does not filter the...

Arbitrary File Read Vulnerability in yxcms Version 1.3.9

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. An arbitrary file read vulnerability exists in yxcms version 1.3.9. An attacker can exploit the vulnerability to obtain sensitive system information...

yxcms V1.3.9 Arbitrary File Deletion Vulnerability in 'tpdel' Function

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. The yxcms V1.3.9 'tpdel' function is vulnerable to arbitrary file deletion. Since the function only passes a non-empty judgment on the string Mname fname, as long as the path is correct, arbitrary files c...