CVE-2018-20557

DouCo DouPHP 1.5 (build 20181221) is affected by a stored/reflected cross-site scripting vulnerability in admin/page.php?rec=edit via the page_name parameter. The issue arises from improper handling of input, permitting injection of arbitrary web script or HTML. Public writeups (CNVD/NVD) describ...

CVE-2018-20558

CVE-2018-20558 affects DouCo DouPHP 1.5 (20181221). The vulnerability is a Cross-Site Scripting (XSS) flaw in admin/system.php?rec=update, exploitable via the site_name parameter . This could allow an attacker to inject arbitrary web script/HTML that is rendered by a user’s browser; CVSS scores i...

CVE-2018-20561

CVE-2018-20561 affects DouCo DouPHP 1.5 20181221. The vulnerability is a stored/reflected XSS in admin/article.php?rec=update via the title parameter, enabling injection of arbitrary script/HTML as described in multiple sources. Affected component is the admin interface (article update logic) and...

CVE-2018-20557

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...

CVE-2018-20565

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the navname parameter...

CVE-2018-20559

The CVE-2018-20559 entry affects DouCo DouPHP 1.5 (build 20181221). The vulnerability is an XSS flaw in admin/product.php?rec=update that is exploitable via the name parameter, enabling injection of arbitrary script/HTML. Underlying cause: insufficient input sanitization on the name field. Docume...

PT-2018-15427

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the "admin/page.php?rec=edit" endpoint has a cross-site scripting XSS issue via the page name parameter. Recommendations For DouPHP version 1.5 20181221,...

CVE-2018-20567: Incorrect Permission Assignment for Critical Resource

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

CVE-2018-20566: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page...

PT-2018-15430

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in the software, where the "admin/show.php?rec=update" API endpoint has a cross-site scripting XSS issue via the show name parameter. Recommendations For DouPHP version 1.5...

CVE-2018-20559: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter...

PT-2018-15433

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP. The "admin/mobile.php?rec=system&act=update" endpoint has a cross-site scripting XSS issue via the mobile name parameter. Recommendations For DouPHP version 1.5...

PT-2018-15429

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP. The "admin/product.php?rec=update" API endpoint has a cross-site scripting XSS issue via the name parameter. Recommendations For DouPHP version 1.5 20181221, avoi...

PT-2018-15432

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the "admin/article category.php?rec=update" API endpoint has a cross-site scripting XSS issue via the cat name parameter. Recommendations For DouPHP version...

CVE-2018-20565: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the navname parameter...

CVE-2018-20562: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/articlecategory.php?rec=update has XSS via the catname parameter...

CVE-2018-20561: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter...

PT-2018-15437

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the /install/index.php endpoint allows a reload of the product under certain circumstances when the install.lock file cannot be read. Recommendations For...

CVE-2018-20564: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/productcategory.php?rec=update has XSS via the catname parameter...

PT-2018-15436

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue in DouPHP allows full path disclosure in "Smarty error: unable to read resource" error messages when a crafted installation page is used. Recommendations For DouPHP version 1.5 20181221, conside...