CVE-2018-18084

An SQL injection vulnerability exists in DuomiCMS 3.0 within the ajax.php file. The flaw is triggered via the uid parameter, which allows for improper neutralization of special elements used in an SQL command. This vulnerability has been observed in the wild and identified in honeypot environment...

CVE-2018-18083

CVE-2018-18083 affects DuomiCMS 3.0. Affected component: search.php, where the parameter searchword is processed and unsafely uses eval during if processing, enabling remote PHP code execution. This yields high/severe impact (NVD CVSS3: 9.8, CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploit...