Design/Logic Flaw

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

PT-2019-13906

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.15 Description The issue allows for XSS via the keywords parameter in the "admincp.php?app=apps" endpoint. Recommendations For iCMS version 7.0.15, avoid using the keywords parameter in the "admincp.php?app=apps" endpoint unti...

PT-2019-18475

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered that allows directory traversal via the app parameter, set to /../, in the "admincp.php?app=apps&do=save" endpoint. This can lead to the creation of a ZIP archive file containi...