CVE-2015-1576

Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to 1 copy2.php, 2 localize.php, 3 metai.php, 4 nc.php, 5 new2.php, or 6 rename2.php in u5admin/; 7 c parameter to u5admin/editor.php; 8 typ parameter to...

CVE-2015-1577

Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a 1 .. dot dot or 2 full pathname in the f parameter...

Sql injection

Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to 1 copy2.php, 2 localize.php, 3 metai.php, 4 nc.php, 5 new2.php, or 6 rename2.php in u5admin/; 7 c parameter to u5admin/editor.php; 8 typ parameter to...

CVE-2015-1577

CVE-2015-1577 is a directory-traversal vulnerability in u5CMS prior to 3.9.4, affecting the script u5admin/deletefile.php . The issue allows remote attackers to write (and via related advisories delete) arbitrary files by supplying traversal or full path names in the parameter f . Public advisori...

CVE-2015-1576: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to 1 copy2.php, 2 localize.php, 3 metai.php, 4 nc.php, 5 new2.php, or 6 rename2.php in u5admin/; 7 c parameter to u5admin/editor.php; 8 typ parameter to...

PT-2015-5364

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to write to arbitrary files. This can be achieved by providing a 1 .. dot dot or 2 full pathname in the f parameter of the /u5admin/deletefile.php API endpoint...

PT-2015-5365

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via a URL in the pidvesa cookie to "u5admin/pidvesa.php" or the uri paramet...

PT-2015-5363

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "copy2.php", "localize.php", "metai.php", "nc.php", "new2.php", and...

PT-2015-5362

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files. The affected parameters include c, i, l, p to index.php, a or b to...

CVE-2015-1575: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the 1 c, 2 i, 3 l, or 4 p parameter to index.php; the 5 a or 6 b parameter to u5admin/cookie.php; the name parameter to 7 copy.php or 8 delete.php in u5admin/;...