Joyplus-cms Security Vulnerabilities and Issues — Joyplus-cms CVE List

Lucene search

Joyplus-cms ProjectJoyplus-cms

4 matches found

CVE•added 2018/07/18 7:29 p.m.•41 views

CVE-2018-14388

joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.

5.4CVSS5.2AI score0.00148EPSS

CVE•added 2018/07/22 5:29 p.m.•41 views

CVE-2018-14500

joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter.

6.1CVSS6AI score0.0024EPSS

CVE•added 2018/07/17 2:29 a.m.•39 views

CVE-2018-14334

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766.

9.8CVSS9.6AI score0.02647EPSS

CVE•added 2018/07/18 7:29 p.m.•34 views

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.

9.8CVSS9.9AI score0.00264EPSS