Vulnerabilities

TI-2018-06736 CVE-2018-9307 · GHSA-55j4-r973-2gcx

dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html.

LOW 28

dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2018-04-04 No fix listed CWE-79

TI-2018-06537 CVE-2018-9017 · GHSA-7cjr-w9g8-rg4r

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI.

LOW 25

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00537 Published 2018-03-25 No fix listed CWE-79

TI-2018-06536 CVE-2018-9016 · GHSA-h5mq-2jr9-rjq6

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI.

LOW 28

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2018-03-25 No fix listed CWE-79

TI-2018-06535 CVE-2018-9015 · GHSA-p9pj-77v9-h498

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdr_sn…

LOW 25

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdr_sn parameter (aka the CMS search box).

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00537 Published 2018-03-25 No fix listed CWE-79

TI-2018-06534 CVE-2018-9014 · GHSA-78vm-g7w5-gj57

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdr_sn= request.

LOW 35

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdr_sn= request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01113 Published 2018-03-25 No fix listed CWE-200

TI-2018-06445 CVE-2018-8906 · GHSA-5767-rpc7-76rr

dsmall v20180320 has XSS via a crafted street address to…

LOW 28

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/address_id/2.html.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2018-03-22 No fix listed CWE-79

Vulnerabilities

Filters

dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html.

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI.

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI.

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdr_sn…

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdr_sn= request.

dsmall v20180320 has XSS via a crafted street address to…