Cross-site scripting vulnerability in phpwcms (CNVD-2018-13849)

phpwcms is an open source web content management system. A vulnerability exists in phpwcms version 1.8.9. A remote attacker can obtain the installation path of a website via an invalid cross-site scripting injection value...

Code injection

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

Design/Logic Flaw

phpwcms 1.8.9 has XSS in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php via the username aka newlogin field...