Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Ucms
(Ucms_project)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 28 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2018-12-30 | CVE-2018-20598 | UCMS 1.4.7 has ?do=user_addpost CSRF. | Ucms | 8.8 | ||
| 2018-12-30 | CVE-2018-20597 | UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action. | Ucms | 4.8 | ||
| 2018-11-22 | CVE-2018-19437 | UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty. | Ucms | 8.8 | ||
| 2018-09-21 | CVE-2018-17320 | An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action. | Ucms | 6.1 | ||
| 2018-09-14 | CVE-2018-17037 | user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. | Ucms | 8.8 | ||
| 2018-09-14 | CVE-2018-17035 | UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. | Ucms | 9.8 | ||
| 2018-09-14 | CVE-2018-17034 | UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. | Ucms | 6.1 | ||
| 2019-03-07 | CVE-2018-16804 | An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request. | Ucms | 6.1 |