CVE-2018-16346

ChemCMS 1.0.6 is affected by a Cross-Site Scripting (XSS) vulnerability exploitable via the Settings → Site Info field. Connected CNVD and NVD records confirm the vulnerability affecting version 1.0.6 and describe the attack as injecting/executing JavaScript through the Site Info setting; no patc...

CVE-2018-10295

CVE-2018-10295 affects ChemCMS v1.0.6. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be exploited via the public/admin/user/addpost.html page to add an administrator account. This could enable an attacker to gain admin privileges on the affected system. The documents do not pr...