CVE-2018-9850

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request...

CVE-2018-9851

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence...

EUVD-2018-10213

Malware in sbrugna...

EUVD-2018-6579

Malware in sbrugna...

EUVD-2018-10212

Malware in sbrugna...

EUVD-2018-8457

Malware in sbrugna...

EUVD-2018-8277

Malware in sbrugna...

EUVD-2017-6455

Malware in sbrugna...

EUVD-2018-7057

Malware in sbrugna...

EUVD-2018-20841

Malware in sbrugna...

EUVD-2018-21444

Malware in sbrugna...

EUVD-2018-21445

Malware in sbrugna...

EUVD-2018-21442

Malware in sbrugna...

EUVD-2020-13754

Malware in sbrugna...

EUVD-2018-21441

Malware in sbrugna...

EUVD-2018-21446

Malware in sbrugna...

CVE-2020-20975

In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter...

CVE-2018-9852

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23...

CVE-2018-18488

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...

CVE-2018-18487

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mtrand unsafely, resulting in predictable database backup file locations...