CVE-2022-25574

CVE-2022-25574 describes a stored XSS in the upload function /admin/show.php, affecting DouPHP (and related DouPhp/DouShell references in the connected entries). The root cause is insufficient input validation/escaping in the image upload pathway, allowing crafted image files to execute arbitrary...

CVE-2024-57599

CVE-2024-57599 affects DouPHP v1.8 Release 20231203. The vulnerability arises from improper handling of the description parameter in /admin/article.php, allowing an attacker to inject a crafted payload that leads to cross-site scripting and arbitrary code execution. Affected component: descriptio...

CVE-2018-20558

CVE-2018-20558 affects DouCo DouPHP 1.5 (20181221). The vulnerability is a Cross-Site Scripting (XSS) flaw in admin/system.php?rec=update, exploitable via the site_name parameter . This could allow an attacker to inject arbitrary web script/HTML that is rendered by a user’s browser; CVSS scores i...

CVE-2018-20564

CVE-2018-20564 affects DouCo DouPHP 1.5 20181221. The issue is a cross-site scripting (XSS) vulnerability in admin/product_category.php?rec=update via the bidirectional cat_name parameter. The root cause is improper handling of input in that parameter, leading to script injection and potential cl...

CVE-2018-20560

The CVE-2018-20560 entry concerns DouCo DouPHP 1.5 (build 20181221). The vulnerability is a Cross-Site Scripting (XSS) flaw in admin/show.php?rec=update, exploitable via the show_name parameter. The Red Hat/CNVD/CVE cross-referenced entries corroborate the same issue. The available sources do not...

CVE-2018-20562

Vulnerability summary (CVE-2018-20562): DouCo DouPHP 1.5 (build 20181221) contains a cross-site scripting flaw in admin/article_category.php?rec=update, exploitable through the cat_name parameter. The issue is that user-supplied input can be reflected in the page without proper sanitization, enab...

CVE-2018-20563

DouPHP 1.5 (build 20181221) is affected by a Cross-Site Scripting (XSS) vulnerability in admin/mobile.php?rec=system&act=update via the mobile_name parameter. This CVE-2018-20563 is consistently described across NVD, Red Hat, CNVD, CVE lists and related records as an XSS issue; no patch/remediati...

CVE-2018-20561

CVE-2018-20561 affects DouCo DouPHP 1.5 20181221. The vulnerability is a stored/reflected XSS in admin/article.php?rec=update via the title parameter, enabling injection of arbitrary script/HTML as described in multiple sources. Affected component is the admin interface (article update logic) and...

CVE-2018-20565

DouCo DouPHP 1.5 (20181221) is affected by a Cross-Site Scripting (XSS) in admin/nav.php?rec=update via the nav_name parameter. The vulnerability could allow injection of arbitrary web script or HTML in the admin context. No exploit details or definitive remediation are provided in the connected ...

CVE-2018-20559

The CVE-2018-20559 entry affects DouCo DouPHP 1.5 (build 20181221). The vulnerability is an XSS flaw in admin/product.php?rec=update that is exploitable via the name parameter, enabling injection of arbitrary script/HTML. Underlying cause: insufficient input sanitization on the name field. Docume...

CVE-2018-20557

DouCo DouPHP 1.5 (build 20181221) is affected by a stored/reflected cross-site scripting vulnerability in admin/page.php?rec=edit via the page_name parameter. The issue arises from improper handling of input, permitting injection of arbitrary web script or HTML. Public writeups (CNVD/NVD) describ...