Priority HIGH 67
SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01127 · Published 2023-06-20 · No fix listed CWE-89
Priority HIGH 73
SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00919 · Published 2023-04-04 · No fix listed CWE-89
Priority LOW 29
A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authentication.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00517 · Published 2021-10-14 · No fix listed CWE-352
Priority LOW 37
PHPMyWind 5.6 is vulnerable to Remote Code Execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0282 · Published 2021-09-07 · No fix listed CWE-94
Priority LOW 35
Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01803 · Published 2021-08-20 · No fix listed CWE-434
Priority LOW 38
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.03571 · Published 2021-08-20 · No fix listed CWE-77
Priority LOW 24
Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of component " /admin/web_config.php".
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00932 · Published 2021-05-27 · No fix listed CWE-79
Priority LOW 24
Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php".
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00984 · Published 2021-05-27 · No fix listed CWE-79
Priority LOW 23
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00652 · Published 2019-09-23 · No fix listed CWE-79
Priority LOW 29
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00826 · Published 2019-09-23 · No fix listed CWE-79
Priority LOW 29
An issue was discovered in PHPMyWind 5.5.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00873 · Published 2019-03-07 · No fix listed CWE-79
Priority LOW 29
An issue was discovered in PHPMyWind 5.5.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00873 · Published 2019-03-07 · No fix listed CWE-79
Priority LOW 23
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00588 · Published 2019-02-18 · No fix listed CWE-79
Priority LOW 26
An issue was discovered in PHPMyWind 5.5.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01701 · Published 2019-02-05 · No fix listed CWE-22
Priority LOW 28
An issue was discovered in PHPMyWind 5.5.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00436 · Published 2019-02-05 · No fix listed CWE-352
Priority LOW 36
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02107 · Published 2018-09-17 · No fix listed CWE-94
Priority LOW 36
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02107 · Published 2018-09-17 · No fix listed CWE-94
Priority LOW 36
admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02107 · Published 2018-09-17 · No fix listed CWE-94
Priority LOW 36
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02107 · Published 2018-09-17 · No fix listed CWE-94
Priority LOW 25
PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00637 · Published 2018-09-17 · No fix listed CWE-79
Priority LOW 29
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00774 · Published 2018-05-26 · No fix listed CWE-79
Priority LOW 32
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02242 · Published 2017-08-21 · No fix listed CWE-79
THREATIST.IORead the docs