Skip to content
Noroxi

chshcms records

53 published records for vendor chshcms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 23
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

53 records
  • CVE-2022-29660
    43Plan

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.

    CriticalCVSS 9.8No exploitEPSS 12%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2018-17126
    40Plan

    CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.

    CriticalCVSS 9.8No exploitEPSS 3%

    chshcms · cscmsSep 17, 2018

  • CVE-2020-22848
    40Plan

    A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.

    CriticalCVSS 9.8No exploitEPSS 3%

    chshcms · cscmsAug 30, 2021

  • CVE-2018-16731
    39Monitor

    CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then prov

    CriticalCVSS 9.8No exploitEPSS 1%

    chshcms · cscmsSep 8, 2018

  • CVE-2020-28102
    39Monitor

    cscms v4.1 allows for SQL injection via the "js_del" function.

    CriticalCVSS 9.8No exploitEPSS 1%

    chshcms · cscmsJan 11, 2022

  • CVE-2020-28103
    39Monitor

    cscms v4.1 allows for SQL injection via the "page_del" function.

    CriticalCVSS 9.8No exploitEPSS 1%

    chshcms · cscmsJan 11, 2022

  • CVE-2023-26781
    39Monitor

    SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.

    CriticalCVSS 9.8No exploitEPSS 1%

    chshcms · mccmsApr 28, 2023

  • CVE-2020-21238
    39Monitor

    An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.

    CriticalCVSS 9.8No exploitEPSS 1%

    chshcms · cscmsDec 27, 2021

  • CVE-2022-29664
    35Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-29667
    35Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy.

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-29685
    35Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_s

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-29669
    35Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/z

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-28552
    35Monitor

    Cscms 4.1 is vulnerable to SQL Injection.

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · cscmsMay 4, 2022

  • CVE-2023-3235
    35Monitor

    mccms Comic.php pic_api server-side request forgery

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · mccmsJun 14, 2023

  • CVE-2023-3236
    35Monitor

    mccms Comic.php pic_save server-side request forgery

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · mccmsJun 14, 2023

  • CVE-2023-5029
    35Monitor

    mccms 1 sql injection

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · mccmsSep 17, 2023

  • CVE-2018-16732
    35Monitor

    \upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.

    HighCVSS 8.8No exploitEPSS 1%

    chshcms · cscmsSep 8, 2018

  • CVE-2018-16448
    35Monitor

    Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and

    HighCVSS 8.8No exploitEPSS 0%

    chshcms · cscmsSep 4, 2018

  • CVE-2023-29815
    35Monitor

    mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).

    HighCVSS 8.8No exploitEPSS 0%

    chshcms · mccmsApr 28, 2023

  • CVE-2019-6779
    32Monitor

    Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.

    HighCVSS 8.1No exploitEPSS 0%

    chshcms · cscmsJan 24, 2019

  • CVE-2018-17125
    30Monitor

    CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.

    HighCVSS 7.5No exploitEPSS 1%

    chshcms · cscmsSep 17, 2018

  • CVE-2022-27365
    28Monitor

    Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del.

    HighCVSS 7.2No exploitEPSS 1%

    chshcms · cscmsApr 15, 2022

  • CVE-2022-29666
    28Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zh

    HighCVSS 7.2No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-29663
    28Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.

    HighCVSS 7.2No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-29670
    28Monitor

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del

    HighCVSS 7.2No exploitEPSS 1%

    chshcms · cscms music portal systemMay 26, 2022