CVE-2018-15566

CVE-2018-15566 affects tp5cms prior to or on 2017-05-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the q parameter in admin.php/article/index.html, enabling injection of arbitrary script/HTML. Affected component is tp5cms’s admin article listing functionality; root ca...

CVE-2018-15566: Improper Neutralization of Input During Web Page Generation

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

CVE-2018-15568: Cross-Site Request Forgery (CSRF)

tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html...

tp5cms Cross-site Scripting Vulnerability

tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site scripting vulnerability exists in tp5cms 2017-05-25 and earlier versions. A remote attacker can exploit this vulnerability to inject...

tp5cms Cross-Site Request Forgery Vulnerability

tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site request forgery vulnerability exists in tp5cms 2017-05-25 and earlier versions. A remote attacker can exploit this vulnerability to delete...

PT-2018-13091

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for XSS via the q parameter in the "admin.php/article/index.html" API endpoint. Recommendations For versions prior to 2017-05-25, avoid using the q parameter in the...

PT-2018-13093

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for CSRF via the "admin.php/category/delete.html" endpoint. This can potentially lead to unauthorized actions on the affected system. Recommendations For versions prior to...