GX
Vendor
Gxlcms
15
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-20975 | GX Gxlcms Gxlcms | 9.8 | Aug 12 | In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter |
| CVE-2018-18488 | GX Gxlcms Gxlcms | 9.8 | Oct 18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter |
| CVE-2018-18487 | GX Gxlcms Gxlcms | 7.5 | Oct 18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations |
| CVE-2018-16655 | GX Gxlcms Gxlcms | 6.1 | Sep 7 | Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php |
| CVE-2018-16437 | GX Gxlcms Gxlcms | 4.9 | Sep 5 | Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator |
| CVE-2018-16436 | GX Gxlcms Gxlcms | 7.2 | Sep 5 | Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator |
| CVE-2018-15177 | GX Gxlcms Gxlcms | 8.8 | Aug 8 | In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account |
| CVE-2018-14685 | GX Gxlcms Gxlcms | 9.8 | Jul 28 | The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id… |
| CVE-2018-9852 | GQ Gxlcms QY Gxlcms | 9.8 | Apr 8 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a… |
| CVE-2018-9851 | GQ Gxlcms QY Gxlcms | 7.5 | Apr 8 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use… |
| CVE-2018-9850 | GQ Gxlcms QY Gxlcms | 7.5 | Apr 8 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an… |
| CVE-2018-9848 | GQ Gxlcms QY Gxlcms | 9.8 | Apr 7 | In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an… |
| CVE-2018-9847 | GQ Gxlcms QY Gxlcms | 9.8 | Apr 7 | In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this code into a template |
| CVE-2018-9247 | GQ Gxlcms QY Gxlcms | 9.8 | Apr 4 | The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter |
| CVE-2017-14979 | GX Gxlcms Gxlcms | 7.5 | Oct 3 | Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s… |