CVE-2018-19197

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths=../ directory traversal...

CVE-2018-19196

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types jpg, jpeg, bmp, png, gif, as demonstrated by an...

Design/Logic Flaw

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types jpg, jpeg, bmp, png, gif, as demonstrated by an...

Design/Logic Flaw

An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen...

CVE-2018-19192

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19194

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

CVE-2018-19193

CVE-2018-19193 affects XiaoCms 20141229. There is a Cross‑Site Scripting (XSS) vulnerability via the largest input box on the New news screen, indicating inadequate input handling in that field. Documented impact per sources notes potential script injection with partial integrity impact; no expli...

CVE-2018-19195

CVE-2018-19195 concerns XiaoCms 20141229 where an XSS vulnerability exists in the template\default\show_product.html. The issue is a client-side/script injection risk in that template, with CVSS2 base score 4.3 (MEDIUM) and CVSS3 base score 6.1 (MEDIUM). The connected documents confirm the affect...

CVE-2018-19195

An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\showproduct.html file...

CVE-2018-19196

The CVE-2018-19196 entry concerns XiaoCms 20141229. Affected component: admin/uploadfile.php handling file uploads. Root cause: attackers can bypass file-type restrictions by manipulating the type parameter, enabling remote code execution via an attack like admin/index.php?c=uploadfile&a=uploadif...

CVE-2018-19192

CVE-2018-19192 : XiaoCms 20141229 contains a cross-site request forgery (CSRF) in admin/index.php?c=content&a=add&catid=3, demonstrated by submitting news via the data[content] parameter. The Red Hat/CNVD/CVE mirrors confirm CSRF as the underlying issue. Documented impact is limited to CSRF, enab...

CVE-2018-19194

Vulnerability summary: XiaoCms 20141229 contains a path disclosure flaw where accessing /admin/index.php?c=database can disclose the full filesystem path via a 'failed to open stream' error. This is consistently described across NVD, Red Hat, CNVD, EU and CVE records. Impact: information disclosu...

CVE-2018-19197

CVE-2018-19197 affects XiaoCms 20141229. The issue is in admin/controller/database.php, where an input parameter allows directory traversal via admin/index.php?c=database&a=import&paths[]=../, enabling arbitrary directory deletion. This is the explicit vulnerability described across multiple conn...

CVE-2018-19194

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

CVE-2018-19192

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19193

An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen...

CVE-2018-19196

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types jpg, jpeg, bmp, png, gif, as demonstrated by an...

CVE-2018-19197

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths=../ directory traversal...

Design/Logic Flaw

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

CVE-2018-14331

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...