CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

CVE-2018-16314

The CVE-2018-16314 issue affects idreamsoft iCMS 7.0.11, specifically the admincp.php CSRF verification. If CSRF_TOKEN is absent, the system validates only the Referer header, which can be bypassed via a substring in admincp.php within that header. This describes a CSRF protection bypass vulnerab...

CVE-2018-16314: Cross-Site Request Forgery (CSRF)

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

CVE-2018-16320: Improper Limitation of a Pathname to a Restricted Directory

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

PT-2018-13486

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.11 Description The issue allows for Directory Traversal, resulting in the execution of arbitrary PHP code from a ZIP file. This can be achieved through the admincp.php application, specifically by accessing the...

PT-2018-13483

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.11 Description An issue was discovered in the admincp.php file. When verifying the CSRF TOKEN, if the CSRF TOKEN does not exist, only the Referer header is validated. This validation can be bypassed by including an...

CVE-2018-14415

An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...

Cross site scripting

An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...

CVE-2018-14415

An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...

CVE-2018-14415

An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...

CVE-2018-14415: Improper Neutralization of Input During Web Page Generation

An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...

PT-2018-12497

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS versions prior to 7.0.10 Description An issue exists where XSS is possible via the fourth and fifth input elements on the "admincp.php?app=prop&do=add" screen. Recommendations For versions prior to 7.0.10, update to version...

Sql injection

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

CVE-2018-12498

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

CVE-2018-12498

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

CVE-2018-12498

CVE-2018-12498 affects iCMS v7.0.8. The flaw is a SQL injection in spider.admincp.php triggered by the id parameter in an app=spider&do=batch request to admincp.php, enabling arbitrary SQL execution through that parameter. The root cause is improper handling/validation of user-supplied input in t...

PT-2018-11218

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.8 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the id parameter in an "app=spider&do=batch" request to the "admincp.php" endpoint. Recommendations For iCMS version 7.0.8, avoid using th...

CVE-2018-12498: Improper Neutralization of Special Elements used in an SQL Command

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

CVE-2018-10250

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

CVE-2018-10250

iCMS v7.0.8 contains a Cross-Site Scripting (XSS) vulnerability in the weixin_category action, exploited via the admincp.php keywords parameter. The issue arises from insufficient sanitization of the keywords input, enabling injection of arbitrary script/HTML when interacting with the WeChat Clas...