CVE-2018-14971

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-14973

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS...

CVE-2018-14969

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS...

CVE-2018-14972

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS...

Cross site request forgery (csrf)

An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS...

CVE-2018-14970

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-14969

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS...

Design/Logic Flaw

An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070...

CVE-2018-14973

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS...

Cross site scripting

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS...

CVE-2018-14970

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS...

CVE-2018-14972

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS...

CVE-2018-14975

Summary: QCMS 3.0.1 has a Cross-Site Scripting (XSS) vulnerability in upload/System/Controller/backend/album.php. Concretely : CNVD-2019-10280 describes an XSS in that file affecting QCMS 3.0.1, exploitable by remote attackers to inject arbitrary web script or HTML. This is consistent with CVE-20...