169 matches found
Joyplus CMS suffers from an override access vulnerability
Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . An override access vulnerability exists in Joyplu...
joyplus-cms cross-site scripting vulnerability (CNVD-2018-14238)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...
joyplus-cms SQL Injection Vulnerability (CNVD-2018-14239)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A SQL injection vulnerability exists in the...
CVE-2018-14501
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14500
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
Sql injection
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
Design/Logic Flaw
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14500
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14501
CVE-2018-14501 affects joyplus-cms 1.6.0, where manager/admin_ajax.php is vulnerable to SQL injection via crafted POST data starting with m_id=1 AND SLEEP(5). The vulnerability arises from unsanitized input passed to SQL queries in that endpoint, enabling an attacker to execute arbitrary SQL comm...
CVE-2018-14500
Joyplus-cms 1.6.0 contains a cross-site scripting (XSS) vulnerability in the writer/collect_vod_zhuiju.php endpoint where the keyword parameter can be injected with arbitrary script/HTML. Public disclosures across CVE/NVD/CNVD confirm XSS via the manager/collect/collect_vod_zhuiju.php keyword par...
CVE-2018-14500
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
CVE-2018-14501
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14501: Improper Neutralization of Special Elements used in an SQL Command
manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...
CVE-2018-14500: Improper Neutralization of Input During Web Page Generation
joyplus-cms 1.6.0 has XSS via the manager/collect/collectvodzhuiju.php keyword parameter...
joyplus-cms SQL Injection Vulnerability
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A SQL injection vulnerability exists in joyplus-c...
joyplus-cms cross-site scripting vulnerability (CNVD-2018-17480)
joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A cross-site scripting vulnerability exists in...
CVE-2018-14389
joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...
CVE-2018-14388
joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...