CVE-2015-1604

Adminsystems CMS (asys) is affected by CVE-2015-1604: an unrestricted file upload in asys/site/files.php prior to 4.0.2 lets remote authenticated users upload a file with an executable extension and access it via upload/files/, enabling arbitrary code execution. CVSS v2 base score 6.5 (Partial im...

CVE-2015-1603

Adminsystems CMS is affected by multiple XSS flaws in versions before 4.0.2, exploitable via the page parameter to index.php or the id parameter in a users_users action to asys/site/system.php. The CVE-2015-1603 entry corresponds to these XSS issues (CVSSv2 base 4.3, Medium). Remediation is to up...