CVE-2018-14501

CVE-2018-14501 affects joyplus-cms 1.6.0, where manager/admin_ajax.php is vulnerable to SQL injection via crafted POST data starting with m_id=1 AND SLEEP(5). The vulnerability arises from unsanitized input passed to SQL queries in that endpoint, enabling an attacker to execute arbitrary SQL comm...

CVE-2018-14501

manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...

CVE-2018-14501: Improper Neutralization of Special Elements used in an SQL Command

manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...

CVE-2018-14388

joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

Sql injection

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14388

joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...

CVE-2018-14388

Joyplus-cms 1.6.0 is vulnerable to cross-site scripting (XSS) via the can_search_device parameter sent to manager/admin_ajax.php. The root cause is unsanitized user input in that parameter, allowing arbitrary script execution in a user’s browser. Multiple sources (NVD, Red Hat, CNVD, CNVD, PRION,...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14388: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...

CVE-2018-14389: Improper Neutralization of Special Elements used in an SQL Command

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

Cross site request forgery (csrf)

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096

Joyplus-cms 1.6.0 is affected by a cross-site scripting (XSS) vulnerability exploitable through the device_name parameter in manager/admin_ajax.php?action=save flag=add. The root cause is likely inadequate input sanitization of device_name, allowing injected scripts to be reflected in the applica...

CVE-2018-10096: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in manager/adminajax.php?action=save&tab=prevodtype via the tname parameter...

CVE-2018-8767

Joyplus-cms 1.6.0 is affected by a cross-site scripting (XSS) vulnerability in manager/admin_ajax.php?action=save&tab={pre}vod_type, exploitable via the t_name parameter. Root cause: insufficient input sanitization that allows injected script/HTML. Impact: can inject arbitrary scripts into the vi...

CVE-2018-8767: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS in manager/adminajax.php?action=save&tab=prevodtype via the tname parameter...