CVE-2015-1577

CVE-2015-1577 is a directory-traversal vulnerability in u5CMS prior to 3.9.4, affecting the script u5admin/deletefile.php . The issue allows remote attackers to write (and via related advisories delete) arbitrary files by supplying traversal or full path names in the parameter f . Public advisori...

CVE-2022-32444

CVE-2022-32444 affects u5cms version 8.3.5 and is a URL redirection/open redirect vulnerability. The vulnerability occurs via /loginsave.php, allowing an attacker to redirect a user’s browser to a malicious site. The connected Nuclei template confirms the affected software/component and describes...

CVE-2022-34937

CVE-2022-34937 affects Yuba u5cms v8.3.5 and is due to a Cross-Site Request Forgery vulnerability in the savepage.php component. This CSRF flaw is described as allowing attackers to execute arbitrary code. The NVD entry lists a high impact (C, I, A) with network attack vector and user interaction...

CVE-2015-1576

CVE-2015-1576 affects u5CMS prior to 3.9.4, with multiple SQL injection flaws disclosed in scripts such as copy2.php, localize.php, metai.php, nc.php, new2.php, rename2.php (name parameter), editor.php (c parameter), meta2.php (typ parameter), and rename2.php (newname parameter). The root cause i...

CVE-2022-32442

CVE-2022-32442 affects u5cms 8.3.5. The issue is a stored/reflected XSS on the default home page caused by insufficient input validation of a URL parameter (example: Onmouseover=%27tzgl (96502)%27bad=). Documents confirm HTML injection risk; no explicit exploit details or remediation are provided...

CVE-2015-1575

CVE-2015-1575 affects u5CMS before 3.9.4, with multiple XSS paths due to insufficient input filtering on numerous parameters across index.php, u5admin/* scripts, and related pages. The underlying issue is failure to adequately sanitize inputs (e.g., c, i, l, p, a, b, name, f, typ, n, c, uri, newn...

CVE-2015-1578

CVE-2015-1578 affects u5CMS prior to 3.9.4, where Open Redirect flaws exist in u5admin/pidvesa.php (pidvesa cookie) and u5admin/meta2.php (uri parameter). An attacker can redirect users to arbitrary sites, enabling phishing attempts. Remediation per the sources is to update to 3.9.4 (latest versi...