Vulnerabilities

TI-2019-12453 CVE-2019-16655 · GHSA-x972-83x7-5g8v

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.

LOW 34

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2019-09-21 No fix listed

TI-2019-12454 CVE-2019-16656 · GHSA-qfc5-pp96-pvcv

MEDIUM 45

joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01332 Published 2019-09-21 No fix listed

TI-2019-12458 CVE-2019-16660 · GHSA-4p5j-63r4-89jw

LOW 39

joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00547 Published 2019-09-21 No fix listed CWE-352