Vulnerabilities

Filters

1 selected

42 records

Sort

Vendor: S-cms Clear all filters

TI-2023-14092 CVE-2023-29962 · GHSA-mj36-f2x8-8hgg

S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.

MEDIUM 62

S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00657 Published 2024-01-04 No fix listed CWE-22

TI-2023-06577 CVE-2023-7191 · GHSA-w45j-fvch-23xw

S-CMS reg.php sql injection

LOW 39

A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-31 No fix listed CWE-89

TI-2023-06576 CVE-2023-7190 · GHSA-v36h-px6f-fj58

S-CMS sql injection

LOW 39

A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-31 No fix listed CWE-89

TI-2023-06575 CVE-2023-7189 · GHSA-5rxm-52x2-3298

S-CMS sql injection

LOW 39

A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-31 No fix listed CWE-89

TI-2023-27908 CVE-2023-51052 · GHSA-c2cg-3mhf-8vrh

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.

MEDIUM 50

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27907 CVE-2023-51051 · GHSA-7g3m-9fg6-93r4

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.

HIGH 82

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27906 CVE-2023-51050 · GHSA-888x-p6x5-q8fc

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.

MEDIUM 43

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27905 CVE-2023-51049 · GHSA-v7h2-wwg5-8j32

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.

MEDIUM 43

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-27904 CVE-2023-51048 · GHSA-3mg4-6264-fvx2

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.

MEDIUM 43

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2023-12-21 No fix listed CWE-89

TI-2023-14093 CVE-2023-29963 · GHSA-wr5q-q78q-xq5j

S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE)…

LOW 37

S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01618 Published 2023-05-05 No fix listed CWE-94

TI-2022-04009 CVE-2022-4377 · GHSA-pcwp-jh7x-746c

S-CMS Contact Information Page cross site scripting

LOW 25

A vulnerability was found in S-CMS 5.0 Build 20220328.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00396 Published 2022-12-09 No fix listed CWE-707

TI-2022-07448 CVE-2022-23336 · GHSA-x59f-9jxx-2799

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.

MEDIUM 44

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01096 Published 2022-02-14 No fix listed CWE-89

TI-2020-13846 CVE-2020-20426 · GHSA-9j2x-hm6w-r8w4

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS)…

LOW 28

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2021-12-22 No fix listed CWE-79

TI-2020-13845 CVE-2020-20425 · GHSA-h863-7w93-946r

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS)…

LOW 28

S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2021-12-22 No fix listed CWE-79

TI-2020-13748 CVE-2020-19954 · GHSA-v6pq-9wmc-r634

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0…

LOW 35

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01243 Published 2021-10-14 No fix listed CWE-611

TI-2021-15291 CVE-2021-37270 · GHSA-6g8q-gjhc-wgm2

There is an unauthorized access vulnerability in the CMS Enterprise Website Construction…

MEDIUM 45

There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01485 Published 2021-09-27 No fix listed CWE-862

TI-2020-13546 CVE-2020-19158 · GHSA-9pf3-6896-gpp9

Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to…

LOW 26

Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00713 Published 2021-09-15 No fix listed CWE-79

TI-2020-13829 CVE-2020-20340 · GHSA-c52c-58rq-pmph

A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0…

LOW 35

A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01254 Published 2021-09-01 No fix listed CWE-89

TI-2020-13518 CVE-2020-19046 · GHSA-692p-7x7m-5hxg

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary…

LOW 26

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00853 Published 2021-08-31 No fix listed CWE-79

TI-2020-13917 CVE-2020-20701 · GHSA-mrxh-52f4-4739

A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows…

LOW 23

A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00579 Published 2021-07-27 No fix listed CWE-79

TI-2020-13916 CVE-2020-20700 · GHSA-9hmw-pcw8-8f4r

A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0…

LOW 23

A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00579 Published 2021-07-27 No fix listed CWE-79

TI-2020-13915 CVE-2020-20699 · GHSA-g85f-77f4-rh9g

A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute…

LOW 23

A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2021-07-27 No fix listed CWE-79

TI-2020-13914 CVE-2020-20698 · GHSA-r2cp-v6f4-j8f3

A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows…

LOW 36

A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0195 Published 2021-07-27 No fix listed CWE-862

TI-2019-12965 CVE-2019-17368 · GHSA-f52w-3j66-jh79

S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.

LOW 29

S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-10-09 No fix listed CWE-79

TI-2019-12279 CVE-2019-16312 · GHSA-hfwg-jgm6-9j42

s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.

LOW 29

s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-09-14 No fix listed CWE-79