Design/Logic Flaw

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

CVE-2018-19437

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

CVE-2018-19437

CVE-2018-19437 affects UCMS 1.4.7. The vulnerability allows remote authenticated users to change the administrator password via cookie-based authentication: $COOKIE['admin '.cookiehash] can be set to arbitrary non-empty values. This is the root cause and leads to admin access compromise. CVSS det...

Cross site scripting

An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadminaaddpost action...

CVE-2018-17320

An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadminaaddpost action...

CVE-2018-17320

An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadminaaddpost action...

CVE-2018-17320

An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadminaaddpost action...

CVE-2018-17320

CVE-2018-17320 affects UCMS 1.4.6. The issue is a stored XSS in the aaddpost.php flow, triggered via the sadmin/aindex.php minfo parameter within the sadmin_aaddpost action. The vulnerability allows injection of arbitrary script/HTML by a remote attacker. The reports in connected documents confir...

Code injection

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-17034

UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...

CVE-2018-17035

UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...

Design/Logic Flaw

user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3...

CVE-2018-17036

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

Sql injection

UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...

CVE-2018-17036

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-17035

UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...

Code injection

UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...

CVE-2018-17037

user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3...

CVE-2018-17035

UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...

CVE-2018-17036

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...