CVE-2018-9924

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

Design/Logic Flaw

An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname...

CVE-2018-9925

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

CVE-2018-9924

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

CVE-2018-9925

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

CVE-2018-9923

CVE-2018-9923 affects idreamsoft iCMS up to version 7.0.7. The vulnerability is a CSRF in admincp.php that allows an attacker to add an article by sending a crafted request such as app=article&do=save&frame=iPHP. This is described in multiple sources (NVD/NVD mirror and CVE records) and is action...

CVE-2018-9925

The CVE-2018-9925 issue affects idreamsoft iCMS up to version 7.0.7. An XSS vulnerability exists in the nickname field processed by the admincp.php?app=user&do=save&frame=iPHP request. The connected sources corroborate a cross-site scripting vulnerability in iCMS 7.0.7 and earlier, enabling injec...

CVE-2018-9924

CVE-2018-9924 affects idreamsoft iCMS up to version 7.0.7. The vulnerability is a SQL injection via the pid array parameter in admincp.php?app=tag&do=save&frame=iPHP. Exploitation details are not provided beyond the description; the CVSS metrics in the entry indicate high/critical impact (CRITICA...

CVE-2018-9922

An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname...

CVE-2018-9923

An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request...

CVE-2018-9922

CVE-2018-9922 affects idreamsoft iCMS up to version 7.0.7. The issue is a physical path leakage caused by an invalid nickname field that reveals the core/library/weixin.class.php pathname. Exploitation details are not provided in the connected documents. No remediation steps or patched versions a...

CVE-2018-9924

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

idreamsoft iCMS Physical Path Disclosure Vulnerability

iCMS is an efficient and simple content management system built with PHP and MySQL. A physical path leak vulnerability exists in idreamsoft iCMS version 7.0.7 and lower. An attacker can obtain the physical path by displaying an invalid nickname field in the core/library/weixin.class.php pathname...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability by sending an...

idreamsoft iCMS Cross-Site Scripting Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the nickname...

idreamsoft iCMS SQL Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'pid' array parameter in the...

HAIRUICMS v2.1.4 Database Backup Vulnerability in DataM.asp File

HAIRUICMS HAIRUICMS is developed by HAIRUICMS based on Microsoft ASP and general ACCESS/MSSQL database. A database backup vulnerability exists in the HAIRUICMS v2.1.4 DataM.asp file. The vulnerability is caused by not filtering both the database path to be backed up and the backup storage path,...

File Renaming Vulnerability in HAIRUICMS v2.1.4 /FileManage/fsorename.asp File

HAIRUICMS HAIRUICMS is developed by HAIRUICMS based on Microsoft ASP and general ACCESS/MSSQL database. A file renaming vulnerability exists in the HAIRUICMS v2.1.4 /FileManage/fsorename.asp file. The vulnerability is caused by not filtering the file name suffix, resulting in the image can be...

Code Execution Vulnerability in HAIRUICMS v2.1.4 Site.asp File

HAIRUICMS HAIRUICMS is developed by HAIRUICMS based on Microsoft ASP and general ACCESS/MSSQL database. A code execution vulnerability exists in the HAIRUICMS v2.1.4 Site.asp file. The vulnerability is due to the incoming parameters are not filtered directly spliced into the configuration file, t...