CVE-2018-19546

JTBC(PHP) 3.0.1.7 is affected by a CSRF vulnerability exploitable through console/xml/manage.php?type=action&action=edit, demonstrated by an XSS payload in the content parameter. The NVD entry assigns CVSSv3.0 base score 8.8 (vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with network acc...

CVE-2018-19547

CVE-2018-19547 affects JTBC(PHP) 3.0.1.7 with a reflected/stored XSS in the console/xml/manage.php?type=action&action=edit content parameter. The root cause is an improper handling of the content parameter in that endpoint, enabling injection of arbitrary JavaScript/HTML. The connected documents ...

JTBC (PHP) Cross-Site Request Forgery Vulnerability (CNVD-2018-26794)

JTBC PHP is an open source CMS Content Management System. A cross-site request forgery vulnerability exists in JTBC PHP version 3.0.1.7. A remote attacker can exploit this vulnerability to perform unauthorized operations with the help of console/xml/manage.php?type=action&action=edit URI...

JTBC(PHP) Cross-Site Scripting Vulnerability

JTBC PHP is an open source CMS Content Management System. A cross-site scripting vulnerability exists in JTBC PHP version 3.0.1.7. A remote attacker can exploit the vulnerability by sending the 'content' parameter to console/xml/manage.php?type=action&action=edit URL to inject arbitrary Web scrip...

CVE-2018-19327

An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...

CVE-2018-19327

An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...

Cross site request forgery (csrf)

An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...

CVE-2018-19327

Summary: Multiple sources confirm a CSRF vulnerability in JTBC(PHP) 3.0.1.7, specifically in aboutus/manage.php?type=action&action=add. The issue allows unauthorized operations and is described across CVE-2018-19327 records in NVD/CNVD/PRION lists. Affected component: JTBC(PHP) 3.0.1.7, vulnerabl...

CVE-2018-19327

An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...

CVE-2018-18436

JTBCPHP 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI...

Cross site request forgery (csrf)

JTBCPHP 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI...

CVE-2018-18436

JTBCPHP 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI...

CVE-2018-18436

CVE-2018-18436 affects JTBC(PHP) 3.0. The vulnerability is a CSRF flaw in the account-creation workflow exposed via console/account/manage.php?type=action&action=add, enabling unauthorized account creation. Root cause: CSRF in the account create action; impact includes confidentiality, integrity,...

CVE-2018-18436

JTBCPHP 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI...

JTBC (PHP) File Deletion Vulnerability

JTBC PHP is an open source CMS Content Management System. JTBC PHP 3.0.1.6 version of the file deletion vulnerability , a remote attacker can use /console/file/manage.php?type=action&action=delete&path=c%3A%2F URL to exploit the vulnerability to delete arbitrary files on the system...

JTBC(PHP) Arbitrary Code Execution Vulnerability

JTBC PHP is an open source CMS Content Management System. An arbitrary code execution vulnerability exists in JTBCPHP version 3.0.1.6, which can be exploited by a remote attacker to execute arbitrary PHP code on an affected system by sending a specially crafted HTTP request...

JTBC(PHP) Arbitrary File Read Vulnerability

JTBC PHP is an open source CMS Content Management System. JTBC PHP 3.0.1.6 version of an arbitrary file reading vulnerability , a remote attacker can use /console//console/file/manage.php?type=list&path=c:/URL to exploit the vulnerability in the system to read arbitrary files...

CVE-2018-17837

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substring...

CVE-2018-17838

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file read operations are possible via a /console//console/file/manage.php?type=list&path=c:/ substring...

CVE-2018-17836

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...