CVE-2018-19195

An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\showproduct.html file...

Directory traversal

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths=../ directory traversal...