CVE-2018-19557

The CVE-2018-19557 issue affects arcms (a CMS based on layui/arphp). Affected versions up to 2018-03-19 allow access to index/main, user/useradd, and img/images without authentication due to a lack of authentication checks, enabling unauthorized access. Public sources (NVD/NVD-derived entries and...

CVE-2018-19558

The CVE refers to arcms (a CMS) with a SQL injection flaw in json/newslist caused by unsanitized limit parameter processing in ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php (through 2018-03-19). Affected component is the web application’s PHP backend; the root cause is impro...