Ucms_project Ucms
28 CVEs affecting Ucms_project Ucms. Latest disclosed: 2023-09-17. Critical: 7, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38297 | Critical | 9.8 | 2022-09-12 | UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. |
CVE-2022-35426 | Critical | 9.8 | 2022-08-10 | UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file. |
CVE-2020-25537 | Critical | 9.8 | 2020-11-30 | File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission. |
CVE-2020-25483 | Critical | 9.8 | 2020-10-23 | An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server. |
CVE-2018-17036 | Critical | 9.8 | 2018-09-14 | An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonst… |
CVE-2018-17035 | Critical | 9.8 | 2018-09-14 | UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. |
CVE-2022-28443 | Critical | 9.1 | 2022-04-21 | UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability. |
CVE-2022-42234 | High | 8.8 | 2022-10-14 | There is a file inclusion vulnerability in the template management module in UCMS 1.6 |
CVE-2022-28440 | High | 8.8 | 2022-04-21 | An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2019-12251 | High | 8.8 | 2019-05-21 | sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter. |
CVE-2018-20599 | High | 8.8 | 2018-12-30 | UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action. |
CVE-2018-20598 | High | 8.8 | 2018-12-30 | UCMS 1.4.7 has ?do=user_addpost CSRF. |
CVE-2018-19437 | High | 8.8 | 2018-11-22 | UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values tha… |
CVE-2018-17037 | High | 8.8 | 2018-09-14 | user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. |
CVE-2022-28444 | High | 7.5 | 2022-04-21 | UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. |
CVE-2023-1303 | Medium | 6.3 | 2023-03-09 | A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php of the component S… |
CVE-2022-38527 | Medium | 6.1 | 2022-09-19 | UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page. |
CVE-2018-16804 | Medium | 6.1 | 2019-03-07 | An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request. |
CVE-2018-20600 | Medium | 6.1 | 2018-12-30 | sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action. |
CVE-2018-17320 | Medium | 6.1 | 2018-09-21 | An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action. |