CVE-2018-19194

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

CVE-2018-19196

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types jpg, jpeg, bmp, png, gif, as demonstrated by an...

CVE-2018-19192

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content=add=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19197

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database=import=../ directory traversal...

CVE-2018-19193

An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen...

EUVD-2018-10904

Malware in sbrugna...

EUVD-2018-6253

Malware in sbrugna...

EUVD-2018-10902

Malware in sbrugna...

EUVD-2018-10903

Malware in sbrugna...

EUVD-2018-10901

Malware in sbrugna...

EUVD-2018-10906

Malware in sbrugna...

EUVD-2019-15694

Malware in sbrugna...

EUVD-2018-10905

Malware in sbrugna...

CVE-2019-6127

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...

CVE-2018-19195

An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\showproduct.html file...

Arbitrary File Deletion Vulnerability in XiaoCMS

XiaoCms is a web content management system, provides enterprise building system, station system. XiaoCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete any directory on the server...

XiaoCMS backend has arbitrary file read vulnerability

XiaoCms is a web content management system, provides enterprise building system, station system. An arbitrary file read vulnerability exists in the XiaoCMS backend. An attacker can exploit the vulnerability to read task files...

CVE-2019-6127

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...

CVE-2019-6127

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...

Sql injection

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...