Vulnerabilities > Yxcms

DATE CVE VULNERABILITY TITLE RISK
2018-11-21 CVE-2018-19404 Code Injection vulnerability in Yxcms 1.4.7
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= followed by that URL.
network
low complexity
yxcms CWE-94
6.5
2018-06-29 CVE-2018-13025 Incorrect Permission Assignment for Critical Resource vulnerability in Yxcms 1.4.7
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter.
network
low complexity
yxcms CWE-732
5.5
2018-05-12 CVE-2018-11003 Cross-Site Request Forgery (CSRF) vulnerability in Yxcms 1.4.7
An issue was discovered in YXcms 1.4.7.
network
yxcms CWE-352
4.3
2018-03-20 CVE-2018-8805 Cross-site Scripting vulnerability in Yxcms 1.4.7
Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php in an index.php?r=default/column/index&col=guestbook request.
network
yxcms CWE-79
4.3
2018-03-19 CVE-2018-8761 Unspecified vulnerability in Yxcms 1.4.7
protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.
network
low complexity
yxcms
5.0