Joyplus Project

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Joyplus Project records in CISA KEV

No Joyplus Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records in Joyplus · all components

TI-2019-12454 CVE-2019-16656 · GHSA-qfc5-pp96-pvcv

MEDIUM 45

joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01332 Published 2019-09-21 No fix listed

TI-2019-12458 CVE-2019-16660 · GHSA-4p5j-63r4-89jw

LOW 39

joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00547 Published 2019-09-21 No fix listed CWE-352

TI-2019-12453 CVE-2019-16655 · GHSA-x972-83x7-5g8v

LOW 34

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2019-09-21 No fix listed