Vulnerabilities > Ucms Project > Ucms > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-12-30 | CVE-2018-20599 | Code Injection vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action. | 6.5 |
| 2018-12-30 | CVE-2018-20598 | Cross-Site Request Forgery (CSRF) vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 has ?do=user_addpost CSRF. | 6.8 |
| 2018-11-22 | CVE-2018-19437 | Unspecified vulnerability in Ucms Project Ucms 1.4.7 UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty. | 4.0 |
| 2018-09-21 | CVE-2018-17320 | Cross-site Scripting vulnerability in Ucms Project Ucms 1.4.6 An issue was discovered in UCMS 1.4.6. | 4.3 |
| 2018-09-14 | CVE-2018-17037 | Incorrect Permission Assignment for Critical Resource vulnerability in Ucms Project Ucms 1.4.6 user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. | 6.5 |
| 2018-09-14 | CVE-2018-17034 | Cross-site Scripting vulnerability in Ucms Project Ucms 1.4.6 UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. | 4.3 |