Vulnerabilities

TI-2018-10763 CVE-2018-14957 · GHSA-x3wm-2593-94c6

CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as…

MEDIUM 45

CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_documenti/../.././inc/config.php (one can take the control of the application because…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0163 Published 2018-09-28 No fix listed CWE-22

TI-2018-10762 CVE-2018-14956 · GHSA-5fjm-4xr4-5vjj

CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws.

MEDIUM 47

CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02562 Published 2018-09-28 No fix listed CWE-89

TI-2018-11097 CVE-2018-15562 · GHSA-c6xq-74jw-x84c

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.

LOW 29

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00978 Published 2018-08-29 No fix listed CWE-79

Vulnerabilities

Filters

CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as…

CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws.

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.