Vulnerabilities

Filters

2 selected

41 records

Sort

Vendor: S-cms Component: S-cms Clear all filters

TI-2023-14092 CVE-2023-29962 · GHSA-mj36-f2x8-8hgg

S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.

MEDIUM 62

S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00657 Published 2024-01-04 No fix listed CWE-22

TI-2023-06577 CVE-2023-7191 · GHSA-w45j-fvch-23xw

S-CMS reg.php sql injection

LOW 39

A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-31 No fix listed CWE-89

TI-2023-06576 CVE-2023-7190 · GHSA-v36h-px6f-fj58

S-CMS sql injection

LOW 39

A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-31 No fix listed CWE-89

TI-2023-06575 CVE-2023-7189 · GHSA-5rxm-52x2-3298

S-CMS sql injection

LOW 39

A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-31 No fix listed CWE-89

TI-2023-27908 CVE-2023-51052 · GHSA-c2cg-3mhf-8vrh

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.

MEDIUM 50

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27907 CVE-2023-51051 · GHSA-7g3m-9fg6-93r4

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.

HIGH 82

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27906 CVE-2023-51050 · GHSA-888x-p6x5-q8fc

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.

MEDIUM 43

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27905 CVE-2023-51049 · GHSA-v7h2-wwg5-8j32

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.

MEDIUM 43

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27904 CVE-2023-51048 · GHSA-3mg4-6264-fvx2

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.

MEDIUM 43

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-14093 CVE-2023-29963 · GHSA-wr5q-q78q-xq5j

S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE)…

LOW 37

S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01618 Published 2023-05-05 No fix listed CWE-94

TI-2022-04009 CVE-2022-4377 · GHSA-pcwp-jh7x-746c

S-CMS Contact Information Page cross site scripting

LOW 25

A vulnerability was found in S-CMS 5.0 Build 20220328.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00396 Published 2022-12-09 No fix listed CWE-707

TI-2022-07448 CVE-2022-23336 · GHSA-x59f-9jxx-2799

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.

MEDIUM 44

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01096 Published 2022-02-14 No fix listed CWE-89

TI-2020-13846 CVE-2020-20426 · GHSA-9j2x-hm6w-r8w4

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS)…

LOW 28

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2021-12-22 No fix listed CWE-79

TI-2020-13845 CVE-2020-20425 · GHSA-h863-7w93-946r

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS)…

LOW 28

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2021-12-22 No fix listed CWE-79

TI-2020-13748 CVE-2020-19954 · GHSA-v6pq-9wmc-r634

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0…

LOW 35

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01243 Published 2021-10-14 No fix listed CWE-611

TI-2020-13546 CVE-2020-19158 · GHSA-9pf3-6896-gpp9

Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to…

LOW 26

Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00713 Published 2021-09-15 No fix listed CWE-79

TI-2020-13829 CVE-2020-20340 · GHSA-c52c-58rq-pmph

A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0…

LOW 35

A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01254 Published 2021-09-01 No fix listed CWE-89

TI-2020-13518 CVE-2020-19046 · GHSA-692p-7x7m-5hxg

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary…

LOW 26

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00853 Published 2021-08-31 No fix listed CWE-79

TI-2020-13917 CVE-2020-20701 · GHSA-mrxh-52f4-4739

A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows…

LOW 23

A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00579 Published 2021-07-27 No fix listed CWE-79

TI-2020-13916 CVE-2020-20700 · GHSA-9hmw-pcw8-8f4r

A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0…

LOW 23

A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00579 Published 2021-07-27 No fix listed CWE-79

TI-2020-13915 CVE-2020-20699 · GHSA-g85f-77f4-rh9g

A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute…

LOW 23

A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2021-07-27 No fix listed CWE-79

TI-2020-13914 CVE-2020-20698 · GHSA-r2cp-v6f4-j8f3

A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows…

LOW 36

A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0195 Published 2021-07-27 No fix listed CWE-862

TI-2019-12965 CVE-2019-17368 · GHSA-f52w-3j66-jh79

S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.

LOW 29

S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-10-09 No fix listed CWE-79

TI-2019-12279 CVE-2019-16312 · GHSA-hfwg-jgm6-9j42

s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.

LOW 29

s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-09-14 No fix listed CWE-79

TI-2019-07987 CVE-2019-10708 · GHSA-cx7g-7m3q-6pv3

S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.

MEDIUM 47

S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02638 Published 2019-04-02 No fix listed CWE-89