Icmsdev

Icms

18 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2023-42322

  • EPSS 0.32%
  • Veröffentlicht 20.09.2023 21:15:11
  • Zuletzt bearbeitet 21.11.2024 08:22:26

Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.

8.8

CVE-2023-42321

  • EPSS 0.85%
  • Veröffentlicht 20.09.2023 21:15:11
  • Zuletzt bearbeitet 21.11.2024 08:22:25

Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.

6.1

CVE-2019-14976

Exploit
  • EPSS 0.24%
  • Veröffentlicht 12.08.2019 22:15:11
  • Zuletzt bearbeitet 21.11.2024 04:27:48

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.

9.8

CVE-2019-6259

Exploit
  • EPSS 0.31%
  • Veröffentlicht 14.01.2019 14:29:00
  • Zuletzt bearbeitet 21.11.2024 04:46:19

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter.

9.8

CVE-2018-18702

Exploit
  • EPSS 0.26%
  • Veröffentlicht 29.10.2018 12:29:04
  • Zuletzt bearbeitet 21.11.2024 03:56:24

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.

8.8

CVE-2018-16314

Exploit
  • EPSS 0.15%
  • Veröffentlicht 01.09.2018 18:29:00
  • Zuletzt bearbeitet 21.11.2024 03:52:30

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.

7.5

CVE-2018-15895

Exploit
  • EPSS 0.37%
  • Veröffentlicht 27.08.2018 04:29:00
  • Zuletzt bearbeitet 21.11.2024 03:51:40

An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A recor...

7.5

CVE-2018-14858

Exploit
  • EPSS 0.35%
  • Veröffentlicht 02.08.2018 20:29:00
  • Zuletzt bearbeitet 21.11.2024 03:49:56

An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an...

9.8

CVE-2018-14514

Exploit
  • EPSS 0.46%
  • Veröffentlicht 23.07.2018 08:29:00
  • Zuletzt bearbeitet 21.11.2024 03:49:13

An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact.

6.1

CVE-2018-14415

Exploit
  • EPSS 0.24%
  • Veröffentlicht 20.07.2018 01:29:01
  • Zuletzt bearbeitet 21.11.2024 03:49:00

An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.