406 matches found
CVE-2018-14514
The CVE-2018-14514 issue affects idreamsoft iCMS, specifically V7.0.9, with a server-side request forgery (SSRF) flaw that can let an attacker read sensitive files or access an intranet. Related entries (CVE-2018-14858) confirm the underlying cause: the remote function in app/spider/spider_tools....
CVE-2018-14514
An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact...
idreamsoft iCMS Server-Side Request Forgery Vulnerability
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A server-side request forgery vulnerability exists in idreamsoft iCMS version 7.0.9. An attacker can exploit the vulnerability to read sensitive files and access the intranet...
CVE-2018-14415
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...
CVE-2018-14415
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...
Cross site scripting
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...
CVE-2018-14415
CVE-2018-14415 affects idreamsoft iCMS prior to 7.0.10. A cross-site scripting (XSS) vulnerability exists leveraging the fourth and fifth input elements on the page admincp.php?app=prop&do=add. The issue is confirmed by the primary description and corroborated by CNVD/NVD references; CVSS metrics...
CVE-2018-14415
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen...
CVE-2018-13865
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
Design/Logic Flaw
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
CVE-2018-13865
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
CVE-2018-13865
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
CVE-2018-13865
The CVE concerns idreamsoft iCMS 7.0.9. A cross-site scripting (XSS) flaw exists via the callback parameter in the public/api.php uploadpic endpoint, which bypasses the iWAF protection mechanism. This configuration allows arbitrary script execution in contexts relying on the affected API. No expl...
Sql injection
spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...
CVE-2018-12498
spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...
CVE-2018-12498
spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...
CVE-2018-12498
CVE-2018-12498 affects iCMS v7.0.8. The flaw is a SQL injection in spider.admincp.php triggered by the id parameter in an app=spider&do=batch request to admincp.php, enabling arbitrary SQL execution through that parameter. The root cause is improper handling/validation of user-supplied input in t...
CVE-2018-12498
spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...
iCMS Cross-Site Scripting Vulnerability (CNVD-2018-08925)
iCMS is a content management system CMS built with PHP and MySQL databases. A cross-site scripting vulnerability exists in iCMS version 7.0.8. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'keywords' parameter...