Vulnerabilities

TI-2020-13394 CVE-2020-18449 · GHSA-8fj3-r29c-jc2q

Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php

LOW 25

Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0052 Published 2021-08-12 No fix listed CWE-79

TI-2020-13957 CVE-2020-20977 · GHSA-8vw4-xv4w-x2mf

A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS…

LOW 25

A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00503 Published 2021-08-12 No fix listed CWE-79

TI-2019-08111 CVE-2019-10888 · GHSA-6m5g-jqjv-qg37

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html.

LOW 39

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00554 Published 2019-04-05 No fix listed CWE-352

TI-2018-10725 CVE-2018-14911 · GHSA-hw48-8j58-8vvg

A file upload vulnerability exists in ukcms v1.1.7 and earlier.

LOW 34

A file upload vulnerability exists in ukcms v1.1.7 and earlier.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01102 Published 2018-08-03 No fix listed CWE-434

Vulnerabilities

Filters

Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php

A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS…

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html.

A file upload vulnerability exists in ukcms v1.1.7 and earlier.