Phpmywind

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

Phpmywind records in CISA KEV

No Phpmywind vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phpmywind 22 records HIGH

Records

22 records in Phpmywind · all components

TI-2020-13984 CVE-2020-21060 · GHSA-h35h-4f93-342q

SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain…

HIGH 73

SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00919 Published 2023-04-04 No fix listed CWE-89

TI-2020-14047 CVE-2020-21400 · GHSA-5mmx-hq97-58f6

SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to…

HIGH 67

SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01127 Published 2023-06-20 No fix listed CWE-89

TI-2020-13484 CVE-2020-18885 · GHSA-hpp4-fw5h-qqx5

Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via…

LOW 38

Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03571 Published 2021-08-20 No fix listed CWE-77

TI-2021-16779 CVE-2021-39503 · GHSA-mx24-fhg2-2xq8

PHPMyWind 5.6 is vulnerable to Remote Code Execution.

LOW 37

PHPMyWind 5.6 is vulnerable to Remote Code Execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0282 Published 2021-09-07 No fix listed CWE-94

TI-2018-12242 CVE-2018-17134 · GHSA-34x5-h37x-3w3p

admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via…

LOW 36

admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02107 Published 2018-09-17 No fix listed CWE-94

TI-2018-12241 CVE-2018-17133 · GHSA-7w3c-66g3-8h6j

admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.

LOW 36

admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02107 Published 2018-09-17 No fix listed CWE-94

TI-2018-12240 CVE-2018-17132 · GHSA-rrg2-5w5v-6crw

admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via…

LOW 36

admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02107 Published 2018-09-17 No fix listed CWE-94

TI-2018-12239 CVE-2018-17131 · GHSA-4vf9-q573-42vp

admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.

LOW 36

admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02107 Published 2018-09-17 No fix listed CWE-94

TI-2020-13485 CVE-2020-18886 · GHSA-57j6-qvj2-vmvh

Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary…

LOW 35

Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01803 Published 2021-08-20 No fix listed CWE-434

TI-2017-09627 CVE-2017-12984 · GHSA-cxwx-gh97-x2x8

PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.

LOW 32

PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02242 Published 2017-08-21 No fix listed CWE-79

TI-2020-13754 CVE-2020-19964 · GHSA-c4r3-rghf-7rx8

A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which…

LOW 29

A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authentication.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00517 Published 2021-10-14 No fix listed CWE-352

TI-2019-12495 CVE-2019-16703 · GHSA-w58p-9fj9-w99w

admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.

LOW 29

admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00826 Published 2019-09-23 No fix listed CWE-79

TI-2019-05399 CVE-2019-7661 · GHSA-xfwh-3cg2-6hcv

An issue was discovered in PHPMyWind 5.5.

LOW 29

An issue was discovered in PHPMyWind 5.5.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00873 Published 2019-03-07 No fix listed CWE-79

TI-2019-05398 CVE-2019-7660 · GHSA-gx9r-6g8g-8wgx

An issue was discovered in PHPMyWind 5.5.

LOW 29

An issue was discovered in PHPMyWind 5.5.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00873 Published 2019-03-07 No fix listed CWE-79

TI-2018-08208 CVE-2018-11487 · GHSA-53vj-p32r-8ch2

PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.

LOW 29

PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00774 Published 2018-05-26 No fix listed CWE-79

TI-2019-05269 CVE-2019-7402 · GHSA-qxq4-g2fh-cv8h

An issue was discovered in PHPMyWind 5.5.

LOW 28

An issue was discovered in PHPMyWind 5.5.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00436 Published 2019-02-05 No fix listed CWE-352

TI-2019-05270 CVE-2019-7403 · GHSA-hjj2-qq3c-3555

An issue was discovered in PHPMyWind 5.5.

LOW 26

An issue was discovered in PHPMyWind 5.5.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.01701 Published 2019-02-05 No fix listed CWE-22

TI-2018-12238 CVE-2018-17130 · GHSA-w69v-xfw6-rr96

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,

LOW 25

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00637 Published 2018-09-17 No fix listed CWE-79

TI-2020-13352 CVE-2020-18230 · GHSA-c2mf-6c8w-693h

Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary…

LOW 24

Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php".

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00984 Published 2021-05-27 No fix listed CWE-79

TI-2020-13351 CVE-2020-18229 · GHSA-r2cg-2xj6-99w5

Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary…

LOW 24

Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of component " /admin/web_config.php".