Vulnerabilities

TI-2026-01874 CVE-2026-2226 · GHSA-hp62-q4v5-3g77

DouPHP ZIP File file.php unrestricted upload

MEDIUM 56

A vulnerability has been found in DouPHP up to 1.9.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00405 Published 2026-02-09 No fix listed CWE-284

TI-2024-37954 CVE-2024-57599 · GHSA-7ghx-59p7-w2w6

Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to…

MEDIUM 55

Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injected into the description parameter in /admin/article.php

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00332 Published 2025-02-06 No fix listed CWE-79

TI-2024-07339 CVE-2024-7917 · GHSA-qhrh-2828-h98h

DouPHP Favicon system.php unrestricted upload

MEDIUM 56

A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00588 Published 2024-08-18 No fix listed CWE-434

TI-2022-22955 CVE-2022-46438 · GHSA-7g72-m37j-c82m

A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component…

LOW 25

A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the descriptio…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00404 Published 2023-01-12 No fix listed CWE-79

TI-2022-08076 CVE-2022-24131 · GHSA-pp7c-rg85-7pxj

DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through…

LOW 29

DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2022-03-30 No fix listed CWE-79

TI-2022-09173 CVE-2022-25574 · GHSA-46wj-w3vw-88rm

A stored cross-site scripting (XSS) vulnerability in the upload function of…

LOW 22

A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00432 Published 2022-03-25 No fix listed CWE-79

TI-2021-02352 CVE-2021-3370 · GHSA-7rr4-2h5v-8fm6

DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.

LOW 28

DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00581 Published 2021-12-08 No fix listed CWE-79

TI-2019-09379 CVE-2019-12564 · GHSA-89ff-6c66-w9m5

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file…

MEDIUM 46

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02011 Published 2019-06-02 No fix listed CWE-287

TI-2018-14590 CVE-2018-20567 · GHSA-7ghg-23h8-fj3m