CVE-2018-20598

UCMS 1.4.7 has ?do=user_addpost CSRF.

CVE-2020-20781

A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the title, key words, description or content text fields.

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.

CVE-2018-19437

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE['admin '.cookiehash] is used for arbitrary cookie values that are set and not empty.

CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.

CVE-2019-12251

sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.

CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.

CVE-2023-5015

A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclos...