Ucms Project Ucms vulnerabilities

• ucms project ucms UCMS cross site scripting CVE-2023-5015 3.5 LowSeptember 17, 2023
• ucms project ucms UCMS Column Configuration saddpost.php cross site scripting CVE-2023-2294 3.5 LowApril 26, 2023
• ucms project ucms UCMS System File Management Module fileedit.php unrestricted upload CVE-2023-1303 6.3 MediumMarch 9, 2023
• ucms project ucms There is a file inclusion vulnerability in the template management module in UCMS 1.6 CVE-2022-42234 8.8 HighOctober 14, 2022
• ucms project ucms UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import... CVE-2022-38527 6.1 MediumSeptember 19, 2022
• ucms project ucms UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. CVE-2022-38297 9.8 CriticalSeptember 12, 2022
• ucms project ucms UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file. CVE-2022-35426 9.8 CriticalAugust 9, 2022
• ucms project ucms An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code... CVE-2022-28440 8.8 HighApril 21, 2022
• ucms project ucms UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. CVE-2022-28444 7.5 HighApril 21, 2022
• ucms project ucms UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability. CVE-2022-28443 9.1 CriticalApril 21, 2022
• ucms project ucms A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7... CVE-2020-20781 5.4 MediumSeptember 29, 2021
• ucms project ucms UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the... CVE-2021-25809 5.3 MediumJuly 23, 2021
• ucms project ucms File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this... CVE-2020-25537 9.8 CriticalNovember 30, 2020
• ucms project ucms An arbitrary command execution vulnerability exists in the fopen() function of file writes of... CVE-2020-25483 9.8 CriticalOctober 23, 2020
• ucms project ucms An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8. This results in... CVE-2020-24981 5.3 MediumSeptember 4, 2020
• ucms project ucms sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost... CVE-2019-12251 8.8 HighMay 21, 2019
• ucms project ucms An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do... CVE-2018-16804 6.1 MediumMarch 7, 2019
• ucms project ucms UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action. CVE-2018-20601 4.8 MediumDecember 30, 2018
• ucms project ucms sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action. CVE-2018-20600 6.1 MediumDecember 30, 2018
• ucms project ucms UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an... CVE-2018-20599 8.8 HighDecember 30, 2018
• ucms project ucms UCMS 1.4.7 has ?do=user_addpost CSRF. CVE-2018-20598 8.8 HighDecember 30, 2018
• ucms project ucms UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action. CVE-2018-20597 4.8 MediumDecember 30, 2018
• ucms project ucms UCMS 1.4.7 allows remote authenticated users to change the administrator password because ... CVE-2018-19437 8.8 HighNovember 22, 2018
• ucms project ucms An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php... CVE-2018-17320 6.1 MediumSeptember 21, 2018
• ucms project ucms user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user... CVE-2018-17037 8.8 HighSeptember 14, 2018
• ucms project ucms An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation... CVE-2018-17036 9.8 CriticalSeptember 14, 2018
• ucms project ucms UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. CVE-2018-17035 9.8 CriticalSeptember 14, 2018
• ucms project ucms UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. CVE-2018-17034 6.1 MediumSeptember 14, 2018