CVE-2020-20975 | Critical | 9.8 | 2021-08-12 | In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter. |
CVE-2018-18488 | Critical | 9.8 | 2018-10-18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter. |
CVE-2018-18487 | High | 7.5 | 2018-10-18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database ba… |
CVE-2018-16655 | Medium | 6.1 | 2018-09-07 | Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php. |
CVE-2018-16437 | Medium | 4.9 | 2018-09-05 | Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator. |
CVE-2018-16436 | High | 7.2 | 2018-09-05 | Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator. |
CVE-2018-15177 | High | 8.8 | 2018-08-08 | In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account. |
CVE-2018-14685 | Critical | 9.8 | 2018-07-28 | The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Adm… |
CVE-2018-9852 | Critical | 9.8 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query str… |
CVE-2018-9851 | High | 7.5 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as d… |
CVE-2018-9850 | High | 7.5 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parame… |
CVE-2018-9848 | Critical | 9.8 | 2018-04-07 | In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using… |
CVE-2018-9847 | Critical | 9.8 | 2018-04-07 | In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this c… |
CVE-2018-9247 | Critical | 9.8 | 2018-04-04 | The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql… |
CVE-2017-14979 | High | 7.5 | 2017-10-03 | Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathn… |