Vulnerabilities

TI-2020-13956 CVE-2020-20975 · GHSA-529j-7j2f-wxwr

In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.

MEDIUM 45

In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0128 Published 2021-08-12 No fix listed CWE-89

TI-2018-13074 CVE-2018-18488 · GHSA-pjf8-cqc5-qhf8

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.

MEDIUM 44

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01135 Published 2018-10-18 No fix listed CWE-89

TI-2018-13073 CVE-2018-18487 · GHSA-p723-226c-99cr

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename…

LOW 35

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01208 Published 2018-10-18 No fix listed CWE-200

TI-2018-11940 CVE-2018-16655 · GHSA-4g48-m7qw-9j6j

Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

LOW 29

Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0073 Published 2018-09-07 No fix listed CWE-79

TI-2018-11784 CVE-2018-16437 · GHSA-hqph-f7jg-6r3f

Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.

LOW 26

Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.0156 Published 2018-09-05 No fix listed CWE-22

TI-2018-11783 CVE-2018-16436 · GHSA-w75c-hc9v-424g

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

LOW 35

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01454 Published 2018-09-05 No fix listed CWE-89

TI-2018-10861 CVE-2018-15177 · GHSA-m9jp-hmvw-m8rm

In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.

LOW 39

In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00579 Published 2018-08-08 No fix listed CWE-352

TI-2018-10542 CVE-2018-14685 · GHSA-jqw5-mcm2-2gp8

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows…

MEDIUM 46

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.p…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02143 Published 2018-07-28 No fix listed CWE-200

TI-2017-10998 CVE-2017-14979 · GHSA-8gc3-r22g-xgpq

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access…

LOW 36

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Ac…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01466 Published 2017-10-02 No fix listed

Vulnerabilities

Filters