CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

Design/Logic Flaw

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

Design/Logic Flaw

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20598

UCMS 1.4.7 has ?do=useraddpost CSRF...

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

Design/Logic Flaw

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

Design/Logic Flaw

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20597

UCMS 1.4.7 is affected by a cross-site scripting (XSS) vulnerability caused by unsafely handling the dir parameter in the sadmin_fileedit action of index.php. The issue allows injection of arbitrary HTML/JavaScript in user-visible pages. No exploits or practical in-the-wild details are provided i...

CVE-2018-20598

CVE-2018-20598 affects UCMS 1.4.7 and is described in connected records as a Cross-Site Request Forgery (CSRF) vulnerability triggered via the parameter ?do=user_addpost. The vulnerability allows an attacker to abuse CSRF to create an administrator account within UCMS. Root cause is CSRF in the u...

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20598

UCMS 1.4.7 has ?do=useraddpost CSRF...

CVE-2018-20601

UCMS 1.4.7 is affected by a Cross‑Site Scripting (XSS) flaw in the description parameter used by the index.php list_editpost action. The root cause, as described across sources, is unescaped or insufficiently sanitized input in the description field that can be reflected in the rendered page. Thi...

CVE-2018-20600

CVE-2018-20600 affects UCMS 1.4.7 where sadmin\cedit.php is vulnerable to cross-site scripting via the index.php sadmin_cedit action. The vulnerability allows injection of arbitrary web script or HTML, with the CVSS 3.0/2.0 metrics indicating network access, no authentication, user interaction re...

CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20599

CVE-2018-20599 affects UCMS 1.4.7, where input during the index.php sadmin_fileedit action can be used to execute arbitrary PHP code, enabling remote code execution. The issue is described across multiple sources (NVD/Red Hat/NVD mirror), confirming that the vulnerability stems from the sadmin_fi...

CVE-2018-19437

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...