CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Joyplus-cms Project » Joyplus-cms » 1.6.0 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:joyplus-cms_project:joyplus-cms:1.6.0:*:*:*:*:*:*:*
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2020-22124 552 2021-08-18 2021-08-24
5.0
None Remote Low Not required Partial None None
A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.
2 CVE-2019-17175 22 Dir. Trav. 2019-10-04 2019-10-08
5.0
None Remote Low Not required Partial None None
joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.
3 CVE-2018-14500 79 XSS 2018-07-22 2020-02-18
4.3
None Remote Medium Not required None Partial None
joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter.
4 CVE-2018-14389 89 Sql 2018-07-18 2018-09-12
7.5
None Remote Low Not required Partial Partial Partial
joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.
5 CVE-2018-14388 79 XSS 2018-07-18 2018-09-12
3.5
None Remote Medium ??? None Partial None
joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.
6 CVE-2018-14334 434 2018-07-17 2018-09-17
7.5
None Remote Low Not required Partial Partial Partial
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766.
7 CVE-2018-12905 79 XSS 2018-06-27 2018-08-20
4.3
None Remote Medium Not required None Partial None
joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.
8 CVE-2018-12039 89 Exec Code Sql 2018-06-07 2018-07-27
7.5
None Remote Low Not required Partial Partial Partial
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring.
9 CVE-2018-10096 79 XSS 2018-04-13 2018-05-11
3.5
None Remote Medium ??? None Partial None
joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.
10 CVE-2018-10073 79 XSS 2018-04-12 2018-05-14
3.5
None Remote Medium ??? None Partial None
joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.
11 CVE-2018-10028 200 +Info 2018-04-11 2018-05-11
5.0
None Remote Low Not required Partial None None
joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI.
12 CVE-2018-8767 79 XSS 2018-03-18 2018-04-13
3.5
None Remote Medium ??? None Partial None
joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter.
13 CVE-2018-8766 434 Exec Code 2018-03-18 2018-04-13
7.5
None Remote Low Not required Partial Partial Partial
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add.
14 CVE-2018-8717 352 CSRF 2018-03-15 2018-04-09
6.8
None Remote Medium Not required Partial Partial Partial
joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request.
Total number of vulnerabilities : 14   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.