Vulnerabilities > Ucms Project
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-12-30 | CVE-2018-20598 | Cross-Site Request Forgery (CSRF) vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 has ?do=user_addpost CSRF. | 8.8 |
| 2018-12-30 | CVE-2018-20597 | Cross-site Scripting vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action. | 4.8 |
| 2018-11-22 | CVE-2018-19437 | Unspecified vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty. | 8.8 |
| 2018-09-21 | CVE-2018-17320 | Cross-site Scripting vulnerability in Ucms Project Ucms 1.4.6 An issue was discovered in UCMS 1.4.6. | 6.1 |
| 2018-09-14 | CVE-2018-17037 | Incorrect Permission Assignment for Critical Resource vulnerability in Ucms Project Ucms 1.4.6 user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. | 8.8 |
| 2018-09-14 | CVE-2018-17036 | Code Injection vulnerability in Ucms Project Ucms 1.4.6/1.6 An issue was discovered in UCMS 1.4.6 and 1.6. | 9.8 |
| 2018-09-14 | CVE-2018-17035 | SQL Injection vulnerability in Ucms Project Ucms 1.4.6 UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. | 9.8 |
| 2018-09-14 | CVE-2018-17034 | Cross-site Scripting vulnerability in Ucms Project Ucms 1.4.6 UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. | 6.1 |