Vulnerabilities > Ucms Project > Ucms > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-10-14 | CVE-2022-42234 | Files or Directories Accessible to External Parties vulnerability in Ucms Project Ucms 1.6 There is a file inclusion vulnerability in the template management module in UCMS 1.6 | 8.8 |
| 2022-04-21 | CVE-2022-28440 | Unrestricted Upload of File with Dangerous Type vulnerability in Ucms Project Ucms 1.6 An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. | 8.8 |
| 2022-04-21 | CVE-2022-28444 | Path Traversal vulnerability in Ucms Project Ucms 1.6 UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. | 7.5 |
| 2019-05-21 | CVE-2019-12251 | SQL Injection vulnerability in Ucms Project Ucms 1.4.7 sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter. | 8.8 |
| 2018-12-30 | CVE-2018-20599 | Code Injection vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action. | 8.8 |
| 2018-12-30 | CVE-2018-20598 | Cross-Site Request Forgery (CSRF) vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 has ?do=user_addpost CSRF. | 8.8 |
| 2018-11-22 | CVE-2018-19437 | Unspecified vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty. | 8.8 |
| 2018-09-14 | CVE-2018-17037 | Incorrect Permission Assignment for Critical Resource vulnerability in Ucms Project Ucms 1.4.6 user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. | 8.8 |