Phpmywind Phpmywind
22 CVEs affecting Phpmywind Phpmywind. Latest disclosed: 2023-06-20. Critical: 0, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-21060 | High | 8.8 | 2023-04-04 | SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page. |
CVE-2020-21400 | High | 7.2 | 2023-06-20 | SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function. |
CVE-2021-39503 | High | 7.2 | 2021-09-07 | PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject p… |
CVE-2020-18886 | High | 7.2 | 2021-08-20 | Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'. |
CVE-2020-18885 | High | 7.2 | 2021-08-20 | Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'. |
CVE-2018-17134 | High | 7.2 | 2018-09-17 | admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field. |
CVE-2018-17133 | High | 7.2 | 2018-09-17 | admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting. |
CVE-2018-17132 | High | 7.2 | 2018-09-17 | admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter. |
CVE-2018-17131 | High | 7.2 | 2018-09-17 | admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field. |
CVE-2020-19964 | Medium | 6.5 | 2021-10-14 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authenti… |
CVE-2019-16703 | Medium | 6.1 | 2019-09-23 | admin/infolist_add.php in PHPMyWind 5.6 has stored XSS. |
CVE-2019-7661 | Medium | 6.1 | 2019-03-07 | An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability. |
CVE-2019-7660 | Medium | 6.1 | 2019-03-07 | An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demon… |
CVE-2019-7402 | Medium | 6.1 | 2019-02-05 | An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via C… |
CVE-2018-11487 | Medium | 6.1 | 2018-05-26 | PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php. |
CVE-2017-12984 | Medium | 6.1 | 2017-08-21 | PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php. |
CVE-2018-17130 | Medium | 5.4 | 2018-09-17 | PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header, |
CVE-2019-7403 | Medium | 4.9 | 2019-02-05 | An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&t… |
CVE-2020-18230 | Medium | 4.8 | 2021-05-27 | Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of com… |
CVE-2020-18229 | Medium | 4.8 | 2021-05-27 | Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of comp… |