EUVD-2018-6307

Malware in sbrugna...

EUVD-2018-6417

Malware in sbrugna...

CVE-2018-14501: Improper Neutralization of Special Elements used in an SQL Command

manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...

Sql injection

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14388: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS via the manager/adminajax.php cansearchdevice array parameter...

CVE-2018-14389: Improper Neutralization of Special Elements used in an SQL Command

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

Cross site request forgery (csrf)

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-8767: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS in manager/adminajax.php?action=save&tab=prevodtype via the tname parameter...

CVE-2018-8717

CVE-2018-8717 affects joyplus-cms 1.6.0 and is a cross-site request forgery (CSRF) vulnerability. The issue is demonstrated by a CSRF request to manager/admin_ajax.php?action=save&tab={pre}manager that can result in adding an administrator account. The connected sources confirm the vulnerability ...

CVE-2018-8717: Cross-Site Request Forgery (CSRF)

joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/adminajax.php?action=save&tab=premanager request...