Sql injection

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request...

CVE-2018-9922

An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname...

CVE-2018-9925

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

CVE-2018-9925

The CVE-2018-9925 issue affects idreamsoft iCMS up to version 7.0.7. An XSS vulnerability exists in the nickname field processed by the admincp.php?app=user&do=save&frame=iPHP request. The connected sources corroborate a cross-site scripting vulnerability in iCMS 7.0.7 and earlier, enabling injec...

CVE-2018-9923

CVE-2018-9923 affects idreamsoft iCMS up to version 7.0.7. The vulnerability is a CSRF in admincp.php that allows an attacker to add an article by sending a crafted request such as app=article&do=save&frame=iPHP. This is described in multiple sources (NVD/NVD mirror and CVE records) and is action...

CVE-2018-9924

CVE-2018-9924 affects idreamsoft iCMS up to version 7.0.7. The vulnerability is a SQL injection via the pid array parameter in admincp.php?app=tag&do=save&frame=iPHP. Exploitation details are not provided beyond the description; the CVSS metrics in the entry indicate high/critical impact (CRITICA...

CVE-2018-9924

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

CVE-2018-9923

An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request...

CVE-2018-9922

CVE-2018-9922 affects idreamsoft iCMS up to version 7.0.7. The issue is a physical path leakage caused by an invalid nickname field that reveals the core/library/weixin.class.php pathname. Exploitation details are not provided in the connected documents. No remediation steps or patched versions a...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability by sending an...

idreamsoft iCMS SQL Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'pid' array parameter in the...

idreamsoft iCMS Cross-Site Scripting Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the nickname...