308 matches found
PHPMyWind Arbitrary Code Execution Vulnerability (CNVD-2018-19540)
PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A security vulnerability exists in the admin/webconfig.php file in PHPMyWind version 5.5. A remote attacker can exploit this vulnerability to execute arbitrary code with the help of the varvalue fie...
PT-2018-13913
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue allows admin users to execute arbitrary code via the attrvalue array parameter in the 'admin/goods update.php' file. Recommendations For PHPMyWind version 5.5, avoid using the attrvalue array paramet...
PT-2018-13914
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue allows admin users to execute arbitrary code via the rewrite url setting in the admin/web config.php file. Recommendations For PHPMyWind version 5.5, restrict access to the admin/web config.php file...
PT-2018-13915
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue allows admin users to execute arbitrary code by manipulating the cfg author field in conjunction with a crafted cfg webpath field in the admin/web config.php file. Recommendations For PHPMyWind versi...
CVE-2018-17131: Improper Control of Generation of Code
admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...
PHPMyWind Arbitrary Code Execution Vulnerability (CNVD-2018-19542)
PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A security vulnerability exists in the admin/goodsupdate.php file in PHPMyWind version 5.5. The vulnerability can be exploited to execute arbitrary code with the help of the 'attrvalue' array...
PT-2018-13911
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via an HTTP Referer header in the member.php file. Recommendations For PHPMyWind version 5.5, update the member.php file to properly...
CVE-2018-17132: Improper Control of Generation of Code
admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...
Arbitrary File Deletion Vulnerability in PHPMyWind Backend Database Management System
PHPMyWind is a PHP+MySQL based, W3C compliant website building engine for enterprise level website building. An arbitrary file deletion vulnerability exists in the PHPMyWind backend database management. An attacker can exploit the vulnerability to delete arbitrary files...
Code Execution Vulnerability in PHPMyWind v5.5
PHPMyWind is a PHP MySQL-based development , W3C-compliant building engine . A code execution vulnerability exists in PHPMyWind v5.5. The vulnerability originates from updating variables in the cache file, bypassing the filter, continue to generate custom code files, an attacker can exploit the...
Code Execution Vulnerability in PHPMyWind v5.5
PHPMyWind is a PHP MySQL-based development , W3C-compliant building engine . A code execution vulnerability exists in PHPMyWind v5.5. An attacker can exploit the vulnerability to execute arbitrary code...
Stored Cross-Site Scripting Vulnerability in PHPMyWind v5.5 Backend
HPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A stored cross-site scripting vulnerability exists in the backend of PHPMyWind v5.5. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in user...
Code Execution Vulnerability in PHPMyWind v5.5 Backend
HPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A code execution vulnerability exists in the backend of PHPMyWind v5.5. An attacker can exploit the vulnerability to execute code when configuring product parameters...
SQL Injection Vulnerability in PHPMyWind
HPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . There is a SQL injection vulnerability in PHPMyWind, which can be exploited by attackers to obtain sensitive information in the database, resulting in information leakage and operational security risks...
PHPMyWind 5.5前台存在sql注入，可重置管理员密码
...
PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2018-15387)
PHPMyWind is a PHP + MySQL based development , W3C compliant site building engine for enterprise-level site building . A cross-site scripting vulnerability exists in PHPMyWind version 5.5. A remote attacker can exploit this vulnerability by sending the 'cid' parameter to the newsshow.php page or ...
CVE-2018-11487
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php...
CVE-2018-11487
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php...
