Login Request a demo
GX
Product
Gxlcms
by Gxlcms · last CVE Aug 12, 2021
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 3High 4Medium 2Low 0
Severity
All severities9Critical3High4Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Gxlcms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-20975
9.8
1%
Aug 12
In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter
Affected: 1.1
CVE-2018-18488
9.8
1%
Oct 18
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter
Affected: 2.0
CVE-2018-14685
9.8
2%
Jul 28
The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id…
Affected: 1.1.4
CVE-2018-15177
8.8
1%
Aug 8
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account
Affected: 2.0
CVE-2018-18487
7.5
1%
Oct 18
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations
Affected: 2.0
CVE-2017-14979
7.5
1%
Oct 3
Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s…
Affected: All versions, or not specified
CVE-2018-16436
7.2
1%
Sep 5
Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator
Affected: 2.0
CVE-2018-16655
6.1
1%
Sep 7
Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php
Affected: 1.0
CVE-2018-16437
4.9
2%
Sep 5
Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator
Affected: 2.0
Showing 9