Gxlcms Gxlcms Qy
6 CVEs affecting Gxlcms Gxlcms Qy. Latest disclosed: 2018-04-08. Critical: 4, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9852 | Critical | 9.8 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query str… |
CVE-2018-9848 | Critical | 9.8 | 2018-04-07 | In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using… |
CVE-2018-9847 | Critical | 9.8 | 2018-04-07 | In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this c… |
CVE-2018-9247 | Critical | 9.8 | 2018-04-04 | The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql… |
CVE-2018-9851 | High | 7.5 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as d… |
CVE-2018-9850 | High | 7.5 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parame… |