CVE-2020-28092

CVE-2020-28092 affects PESCMS Team 2.3.2 and manifests as multiple reflected XSS via the id parameter in endpoints like ?g=Team&m=Task&a=my&status=...&id= across several pages. Public references (Exploit-DB, Red Hat, CNVD, NVD, OSV, PRION, Pack et al.) corroborate the vulnerability, with exploit ...

CVE-2021-31679

The CVE-2021-31679 entry concerns PESCMS-V2.3.3 and describes a CSRF vulnerability that allows an attacker to delete admin and other members’ account numbers. Affected component is the web application’s account-management flow; root cause is insufficient CSRF protection enabling unauthorized stat...

CVE-2021-31676

CVE-2021-31676 affects PESCMS v2.3.3. The vulnerability is a reflected XSS in the application, arising from missing data validation on user input/output in App/Team/GET/Report.php. When combined with CSRF in the same file, it can enable larger client-side impact. The connected Red Hat and CNVD re...

CVE-2021-31678

CVE-2021-31678 describes a CSRF vulnerability in PESCMS-V2.3.3 that can delete a user’s company import information. Multiple connected sources (NVD, Red Hat, CNVD, OSV, CNVD etc.) corroborate the impact on PESCMS-V2.3.3. The records do not provide a patch version or remediation steps within the d...

CVE-2021-31677

CVE-2021-31677 concerns PESCMS-V2.3.3, where a cross-site request forgery (CSRF) vulnerability can modify passwords for administrators and other members. The issue is described consistently across sources as affecting PESCMS version 2.3.3 and enabling unauthorized password changes via CSRF. Publi...

CVE-2018-16370

The vulnerability CVE-2018-16370 affects PESCMS Team 2.2.1. An attacker can upload and execute arbitrary PHP code by placing a .php file inside a ZIP archive and submitting via /Public/?g=Team&m=Setting&a=upgrade, enabling remote code execution with network access. Exploit details, affected versi...

CVE-2018-16371

CVE-2018-16371 affects PESCMS Team 2.2.1 and involves multiple reflected XSS via the keyword parameter in four endpoints: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=. The provided documents iden...