PT-2018-12551

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns SQL Injection in the manager/admin ajax.php file. This can be exploited by sending crafted POST data, for example, a substring like "m id=1 AND SLEEP5". Recommendations For joyplus-cms...

PT-2018-12482

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for XSS via the "manager/admin ajax.php" API endpoint, specifically through the can search device array parameter. Recommendations For joyplus-cms version 1.6.0, consider restricting acces...

PT-2018-12483

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to SQL Injection, which can be exploited via the val parameter in the "manager/admin ajax.php" API endpoint. Recommendations For joyplus-cms version 1.6.0, avoid using the val paramete...

PT-2018-9677

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a Cross-Site Scripting XSS problem. It is exploited through the device name parameter in a "manager/admin ajax.php?action=save flag=add" request, specifically the "/manager/admin...

PT-2018-18622

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns an XSS vulnerability. It can be exploited via the "manager/admin ajax.php?action=save&tab=prevod type" API endpoint, specifically through the t name parameter. Recommendations For...

PT-2018-18595

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for CSRF, as demonstrated by adding an administrator account via a "manager/admin ajax.php?action=save&tab=premanager" request. This can be exploited by sending a malicious request to the...