Priority HIGH 82
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00534 · Published 2023-12-21 · No fix listed CWE-89
Priority MEDIUM 62
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00657 · Published 2024-01-04 · No fix listed CWE-22
Priority MEDIUM 50
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00534 · Published 2023-12-21 · No fix listed CWE-89
Priority MEDIUM 47
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02638 · Published 2019-04-02 · No fix listed CWE-89
Priority MEDIUM 44
S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01096 · Published 2022-02-14 · No fix listed CWE-89
Priority MEDIUM 44
SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2019-01-25 · No fix listed CWE-89
Priority MEDIUM 44
An issue was discovered in S-CMS 1.0.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2018-12-26 · No fix listed CWE-89
Priority MEDIUM 44
An issue was discovered in S-CMS 1.0.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2018-12-26 · No fix listed CWE-89
Priority MEDIUM 44
An issue was discovered in S-CMS 3.0.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2018-12-26 · No fix listed CWE-89
Priority MEDIUM 44
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2018-11-01 · No fix listed CWE-89
Priority MEDIUM 44
s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01189 · Published 2018-10-17 · No fix listed CWE-89
Priority MEDIUM 43
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00534 · Published 2023-12-21 · No fix listed CWE-89
Priority MEDIUM 43
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00534 · Published 2023-12-21 · No fix listed CWE-89
Priority MEDIUM 43
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00534 · Published 2023-12-21 · No fix listed CWE-89
Priority MEDIUM 43
s-cms 3.0 allows remote attackers to execute arbitrary PHP code by placing this code in a crafted User-agent Disallow value in the robots.php txt parameter.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02446 · Published 2018-10-17 · No fix listed CWE-94
Priority LOW 39
A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00479 · Published 2023-12-31 · No fix listed CWE-89
Priority LOW 39
A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00479 · Published 2023-12-31 · No fix listed CWE-89
Priority LOW 39
A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00479 · Published 2023-12-31 · No fix listed CWE-89
Priority LOW 39
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00614 · Published 2019-03-27 · No fix listed CWE-352
Priority LOW 39
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00572 · Published 2019-02-23 · No fix listed CWE-352
Priority LOW 38
An issue was discovered in S-CMS v1.5.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00465 · Published 2018-11-17 · No fix listed CWE-352
Priority LOW 37
S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01618 · Published 2023-05-05 · No fix listed CWE-94
Priority LOW 36
A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0195 · Published 2021-07-27 · No fix listed CWE-862
Priority LOW 35
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01254 · Published 2021-09-01 · No fix listed CWE-89
Priority LOW 35
An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01243 · Published 2021-10-14 · No fix listed CWE-611
Load more
THREATIST.IORead the docs