Cpe Name:
cpe:2.3:a:joyplus-cms_project:joyplus-cms:1.6.0:*:*:*:*:*:*:*
| # |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
|
1 |
CVE-2020-22124 |
552 |
|
|
2021-08-18 |
2021-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
|
A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information. |
|
2 |
CVE-2019-17175 |
22 |
|
Dir. Trav. |
2019-10-04 |
2019-10-08 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
|
joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal. |
|
3 |
CVE-2018-14500 |
79 |
|
XSS |
2018-07-22 |
2020-02-18 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
|
joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter. |
|
4 |
CVE-2018-14389 |
89 |
|
Sql |
2018-07-18 |
2018-09-12 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
|
joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter. |
|
5 |
CVE-2018-14388 |
79 |
|
XSS |
2018-07-18 |
2018-09-12 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
|
joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter. |
|
6 |
CVE-2018-14334 |
434 |
|
|
2018-07-17 |
2018-09-17 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
|
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766. |
|
7 |
CVE-2018-12905 |
79 |
|
XSS |
2018-06-27 |
2018-08-20 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
|
joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions. |
|
8 |
CVE-2018-12039 |
89 |
|
Exec Code Sql |
2018-06-07 |
2018-07-27 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
|
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring. |
|
9 |
CVE-2018-10096 |
79 |
|
XSS |
2018-04-13 |
2018-05-11 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
|
joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. |
|
10 |
CVE-2018-10073 |
79 |
|
XSS |
2018-04-12 |
2018-05-14 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
|
joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. |
|
11 |
CVE-2018-10028 |
200 |
|
+Info |
2018-04-11 |
2018-05-11 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
|
joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. |
|
12 |
CVE-2018-8767 |
79 |
|
XSS |
2018-03-18 |
2018-04-13 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
|
joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter. |
|
13 |
CVE-2018-8766 |
434 |
|
Exec Code |
2018-03-18 |
2018-04-13 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
|
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add. |
|
14 |
CVE-2018-8717 |
352 |
|
CSRF |
2018-03-15 |
2018-04-09 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
|
joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. |
Total number of vulnerabilities :
14
Page :
1
(This Page)
