CVE-2019-16677

An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF...

CVE-2019-16677: Cross-Site Request Forgery (CSRF)

An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF...

PT-2019-14762

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0 Description An issue was discovered that allows Cross-Site Request Forgery CSRF attacks. The affected endpoint is "admincp.php?app=members&do=del". Recommendations For idreamsoft iCMS version 7.0, consider...

CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

Design/Logic Flaw

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

CVE-2019-14976

CVE-2019-14976 affects iCMS 7.0.15, exposing a cross-site scripting (XSS) vulnerability in the admin panel. The issue arises via the keywords parameter in admincp.php?app=apps, enabling potentially injection of malicious client-side script. Multiple connected sources (NVD/NIST entries and Red Hat...

CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

PT-2019-13906

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.15 Description The issue allows for XSS via the keywords parameter in the "admincp.php?app=apps" endpoint. Recommendations For iCMS version 7.0.15, avoid using the keywords parameter in the "admincp.php?app=apps" endpoint unti...

CVE-2019-14976: Improper Neutralization of Input During Web Page Generation

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

Cross site request forgery (csrf)

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

CVE-2019-1010112

OECMS v4.3.R60321 and later is affected by a Cross Site Request Forgery (CSRF) vulnerability in admincp.php. The attack vector is network connectivity, and the impact is that a victim could be tricked into adding an administrator account. The fixed version is v4.3. This CVE entry corresponds to C...

CVE-2019-1010112: Cross-Site Request Forgery (CSRF)

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

PT-2019-11470

Name of the Vulnerable Software and Affected Versions: OECMS versions prior to v4.3 Description: The issue allows for Cross Site Request Forgery CSRF attacks. This can lead to the victim unintentionally adding an administrator account. The component affected is admincp.php, and the attack vector ...

CVE-2019-11426

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

PT-2019-12305

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.14 Description A cross-site scripting XSS issue was found in the idreamsoft iCMS software. The issue is related to the admincp.php?app=config tab parameter. Recommendations For iCMS version 7.0.14, consider restricting access ...

CVE-2019-11426: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

Directory traversal

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request...