Priority HIGH 82
An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01028 · Published 2023-02-24 · No fix listed CWE-20
Priority LOW 30
Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents function.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00647 · Published 2023-02-24 · No fix listed CWE-125
Priority HIGH 73
Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00612 · Published 2023-02-03 · No fix listed CWE-352
Priority HIGH 73
Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00612 · Published 2023-02-03 · No fix listed CWE-352
Priority MEDIUM 43
A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02461 · Published 2021-08-18 · No fix listed CWE-94
Priority MEDIUM 45
SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01449 · Published 2021-06-23 · No fix listed CWE-89
Priority LOW 36
imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0225 · Published 2020-12-09 · No fix listed CWE-434
Priority MEDIUM 45
An issue was discovered in imcat 4.9.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01537 · Published 2019-08-12 · No fix listed CWE-89
Priority LOW 25
imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00607 · Published 2019-02-18 · No fix listed CWE-79
Priority LOW 29
imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00943 · Published 2018-12-30 · No fix listed CWE-79
Priority LOW 26
imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01898 · Published 2018-12-30 · No fix listed CWE-22
Priority LOW 29
imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02653 · Published 2018-12-30 · No fix listed CWE-200
Priority MEDIUM 47
imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.12063 · Published 2018-12-30 · No fix listed CWE-200
Priority LOW 29
imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02653 · Published 2018-12-30 · No fix listed CWE-200
Priority LOW 38
imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02609 · Published 2018-12-30 · No fix listed CWE-200
Priority MEDIUM 47
imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02387 · Published 2018-12-30 · No fix listed CWE-94
THREATIST.IORead the docs