Filtered by vendor Eyoucms Subscriptions
Total 65 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-36225 1 Eyoucms 1 Eyoucms 2024-11-21 8.8 High
EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add.
CVE-2022-35509 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
An issue was discovered in EyouCMS 1.5.8. There is a Storage XSS vulnerability that can allows an attacker to execute arbitrary Web scripts or HTML by injecting a special payload via the title parameter in the foreground contribution, allowing the attacker to obtain sensitive information.
CVE-2022-33122 1 Eyoucms 1 Eyoucms 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page.
CVE-2022-26279 1 Eyoucms 1 Eyoucms 2024-11-21 9.8 Critical
EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
CVE-2022-26273 1 Eyoucms 1 Eyoucms 2024-11-21 9.8 Critical
EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.
CVE-2021-46255 1 Eyoucms 1 Eyoucms 2024-11-21 8.1 High
eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename.
CVE-2021-42194 1 Eyoucms 1 Eyoucms 2024-11-21 7.2 High
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
CVE-2021-39501 1 Eyoucms 1 Eyoucms 2024-11-21 6.1 Medium
EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function.
CVE-2021-39500 1 Eyoucms 1 Eyoucms 2024-11-21 7.5 High
Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" to escape and write file to writeable directories.
CVE-2021-39499 1 Eyoucms 1 Eyoucms 2024-11-21 6.1 Medium
A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function.
CVE-2021-39497 1 Eyoucms 1 Eyoucms 2024-11-21 9.8 Critical
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.
CVE-2021-39496 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS.
CVE-2021-39428 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filename for edit_users_head_pic.
CVE-2020-28146 1 Eyoucms 1 Eyoucms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
CVE-2020-24000 1 Eyoucms 1 Eyoucms 2024-11-21 9.8 Critical
SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php.
CVE-2020-21930 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
CVE-2020-21929 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
CVE-2020-20645 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.
CVE-2020-20642 1 Eyoucms 1 Eyoucms 2024-11-21 8.8 High
Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn.
CVE-2020-19669 1 Eyoucms 1 Eyoucms 2024-11-21 8.8 High
Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn.