RSS   Podatności dla 'Phpcms'   RSS

2022-06-15
 
CVE-2021-40910

CWE-79
 
 
There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.

 
2021-06-16
 
CVE-2020-22203

CWE-89
 
 
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.

 
 
CVE-2020-22199

CWE-89
 
 
SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.

 
 
CVE-2020-22200

CWE-22
 
 
Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.

 
 
CVE-2020-22201

CWE-77
 
 
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.

 
2019-03-24
 
CVE-2019-10027

CWE-79
 
 
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.

 
2018-11-09
 
CVE-2018-19127

CWE-94
 
 
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.

 
2018-08-05
 
CVE-2018-14940

CWE-400
 
 
PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.

 
2008-01-31
 
CVE-2008-0513

CWE-22
 
 
Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than CVE-2005-1840.

 
2006-06-15
 
CVE-2006-3019

CWE-94
 
 
Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3) class.edit_phpcms.php, (4) class.http_indexer_phpcms.php, (5) class.cache_phpcms.php, (6) class.search_phpcms.php, (7) class.lib_indexer_universal_phpcms.php, and (8) class.layout_phpcms.php, (9) parser/plugs/counter.php, and (10) parser/parser.php. NOTE: the class.cache_phpcms.php vector was also reported to affect 1.1.7.

 

Copyright 2024, cxsecurity.com

 

Back to Top