CVE-2018-9925

The CVE-2018-9925 issue affects idreamsoft iCMS up to version 7.0.7. An XSS vulnerability exists in the nickname field processed by the admincp.php?app=user&do=save&frame=iPHP request. The connected sources corroborate a cross-site scripting vulnerability in iCMS 7.0.7 and earlier, enabling injec...

CVE-2018-10250

iCMS v7.0.8 contains a Cross-Site Scripting (XSS) vulnerability in the weixin_category action, exploited via the admincp.php keywords parameter. The issue arises from insufficient sanitization of the keywords input, enabling injection of arbitrary script/HTML when interacting with the WeChat Clas...

CVE-2018-9922

CVE-2018-9922 affects idreamsoft iCMS up to version 7.0.7. The issue is a physical path leakage caused by an invalid nickname field that reveals the core/library/weixin.class.php pathname. Exploitation details are not provided in the connected documents. No remediation steps or patched versions a...