CVE-2023-31860

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system...

Cross site scripting

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system...

CVE-2023-31860

Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system...

CVE-2023-31860

Wuzhi CMS v3.1.2 has a storage-type XSS vulnerability in the backend of the Five Finger CMS b2b system. Affected component: Wuzhi CMS core/backend; vulnerability type: storage XSS. Documented impact is limited to a cross-site script in backend contexts; CVSSv3.1 base score 5.4 (Medium) with netwo...

CVE-2023-30333

An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-30333

An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-48116

AyaCMS v3.1.2 was discovered to contain a remote code execution RCE vulnerability via the component /admin/tpledit.inc.php...

CVE-2022-46101

AyaCMS v3.1.2 was found to have a code flaw in the ustsql.inc.php file, which allows attackers to cause command execution by inserting malicious code...

Code injection

AyaCMS v3.1.2 was found to have a code flaw in the ustsql.inc.php file, which allows attackers to cause command execution by inserting malicious code...

CVE-2022-46101

AyaCMS v3.1.2 has a code flaw in ust_sql.inc.php that enables command execution via injected code. The vulnerability is described across multiple sources (e.g., Red Hat, CVE records, and PT-Security) with a CVSS v3.1 base score of 8.8 (HIGH) and an attack vector of NETWORK, requiring LOW privileg...

CVE-2022-46101

AyaCMS v3.1.2 was found to have a code flaw in the ustsql.inc.php file, which allows attackers to cause command execution by inserting malicious code...

CVE-2022-44455

The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the...

CVE-2022-44455 The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.

The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the...

CVE-2022-45118 Telephony in communication subsystem sends public events with personal data, but the permission is not set.

OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions...

CVE-2022-45548

AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability...

CVE-2022-45548

AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability...

CVE-2022-45548

CVE-2022-45548 affects AyaCMS v3.1.2 with an Arbitrary File Upload vulnerability. CVSS v3.1 base score 8.8 (HIGH) indicates network access, low attack complexity, and requires low privileges with no user interaction; impact to confidentiality, integrity, and availability is HIGH. The connected do...

CVE-2022-43074

CVE-2022-43074 affects AyaCMS v3.1.2 with an arbitrary file upload vulnerability in the /admin/fst_upload.inc.php component. The issue permits execution of arbitrary code via a crafted PHP file, per the primary CVE description. The associated metrics indicate a 9.8 base score (CRITICAL) under CVS...

CVE-2022-43495

OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardwaredevicemanager when joining a network. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot...

CVE-2022-43449 Arbitrary file read via download_server.

OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via downloadserver. Local attackers can install an malicious application on the device and reveal any file from the filesystem that is accessible to downloadserver service which run with UID 1000...