CVE-2018-20563

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobilename parameter...

CVE-2018-20565

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the navname parameter...

CVE-2018-20559

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter...

Path traversal

An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the showname parameter...

Default credentials

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the navname parameter...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/articlecategory.php?rec=update has XSS via the catname parameter...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobilename parameter...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter...

Design/Logic Flaw

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/productcategory.php?rec=update has XSS via the catname parameter...

Default credentials

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter...

CVE-2018-20566

CVE-2018-20566 affects DouCo DouPHP 1.5 20181221. A crafted installation page can trigger a Smarty error: unable to read resource, leading to full path disclosure. The issue is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists) with the same symptom, but the provided documents do ...

CVE-2018-20563

DouPHP 1.5 (build 20181221) is affected by a Cross-Site Scripting (XSS) vulnerability in admin/mobile.php?rec=system&act=update via the mobile_name parameter. This CVE-2018-20563 is consistently described across NVD, Red Hat, CNVD, CVE lists and related records as an XSS issue; no patch/remediati...

CVE-2018-20562

Vulnerability summary (CVE-2018-20562): DouCo DouPHP 1.5 (build 20181221) contains a cross-site scripting flaw in admin/article_category.php?rec=update, exploitable through the cat_name parameter. The issue is that user-supplied input can be reflected in the page without proper sanitization, enab...

CVE-2018-20560

The CVE-2018-20560 entry concerns DouCo DouPHP 1.5 (build 20181221). The vulnerability is a Cross-Site Scripting (XSS) flaw in admin/show.php?rec=update, exploitable via the show_name parameter. The Red Hat/CNVD/CVE cross-referenced entries corroborate the same issue. The available sources do not...

CVE-2018-20564

CVE-2018-20564 affects DouCo DouPHP 1.5 20181221. The issue is a cross-site scripting (XSS) vulnerability in admin/product_category.php?rec=update via the bidirectional cat_name parameter. The root cause is improper handling of input in that parameter, leading to script injection and potential cl...

CVE-2018-20561

CVE-2018-20561 affects DouCo DouPHP 1.5 20181221. The vulnerability is a stored/reflected XSS in admin/article.php?rec=update via the title parameter, enabling injection of arbitrary script/HTML as described in multiple sources. Affected component is the admin interface (article update logic) and...

CVE-2018-20559

The CVE-2018-20559 entry affects DouCo DouPHP 1.5 (build 20181221). The vulnerability is an XSS flaw in admin/product.php?rec=update that is exploitable via the name parameter, enabling injection of arbitrary script/HTML. Underlying cause: insufficient input sanitization on the name field. Docume...