Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Yxcms Clear all filters
TI-2018-13739 CVE-2018-19404 · GHSA-jm69-h2qj-3qwx

In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote…

Priority LOW 35

In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at a…

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01599 Published 2018-11-21 No fix listed CWE-94
TI-2018-07799 CVE-2018-11003 · GHSA-hvrr-2wvw-8fx3

An issue was discovered in YXcms 1.4.7.

Priority LOW 30

An issue was discovered in YXcms 1.4.7.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00679 Published 2018-05-12 No fix listed CWE-352
TI-2018-06352 CVE-2018-8805 · GHSA-73xp-25v8-f6f4

Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to…

Priority LOW 28

Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php in an index.ph…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2018-03-20 No fix listed CWE-79
TI-2018-06317 CVE-2018-8761 · GHSA-7qf6-36gw-hmq5

protected\apps\member\controller\shopcarController.php in Yxcms building system…

Priority LOW 34

protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00859 Published 2018-03-19 No fix listed