CVE-2018-14415

CVE-2018-14415 affects idreamsoft iCMS prior to 7.0.10. A cross-site scripting (XSS) vulnerability exists leveraging the fourth and fifth input elements on the page admincp.php?app=prop&do=add. The issue is confirmed by the primary description and corroborated by CNVD/NVD references; CVSS metrics...

CVE-2018-14858

The CVE-2018-14858 entry affects idreamsoft iCMS prior to 7.0.11. The vulnerability is an SSRF in the remote function at app/spider/spider_tools.class.php, which does not block DNS hostnames mapped to private/reserved IPs (e.g., 10.0.0.0/8). Root cause is an incomplete fix from CVE-2018-14514. Im...

CVE-2018-15895

CVE-2018-15895 affects idreamsoft iCMS 7.0.11. The vulnerability is an SSRF in the remote function at app/spider/spider_tools.class.php that does not block DNS hostnames tied to private/reserved IPs (e.g., 127.0.0.1), allowing requests to internal addresses. Root cause notes link to an incomplete...