Skip to content
Noroxi

idreamsoft records

30 published records for vendor idreamsoft.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

30 records
  • CVE-2019-7160
    40Plan

    idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execut

    CriticalCVSS 9.8No exploitEPSS 3%

    idreamsoft · icmsJan 29, 2019

  • CVE-2021-44978
    40Plan

    iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.

    CriticalCVSS 9.8No exploitEPSS 2%

    idreamsoft · icmsFeb 4, 2022

  • CVE-2020-19142
    39Monitor

    iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php.

    CriticalCVSS 9.8No exploitEPSS 2%

    idreamsoft · icmsDec 10, 2020

  • CVE-2020-19527
    39Monitor

    iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php.

    CriticalCVSS 9.8No exploitEPSS 2%

    idreamsoft · icmsDec 10, 2020

  • CVE-2019-17552
    39Monitor

    An issue was discovered in idreamsoft iCMS v7.0.14.

    CriticalCVSS 9.8No exploitEPSS 1%

    idreamsoft · icmsOct 14, 2019

  • CVE-2022-41496
    39Monitor

    iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    idreamsoft · icmsOct 13, 2022

  • CVE-2023-39806
    39Monitor

    iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.

    CriticalCVSS 9.8No exploitEPSS 1%

    idreamsoft · icmsAug 10, 2023

  • CVE-2023-39805
    39Monitor

    iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    idreamsoft · icmsAug 10, 2023

  • CVE-2019-7234
    37Monitor

    An issue was discovered in idreamsoft iCMS 7.0.13.

    CriticalCVSS 9.1No exploitEPSS 2%

    idreamsoft · icmsJan 30, 2019

  • CVE-2020-18070
    37Monitor

    Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()"

    CriticalCVSS 9.1No exploitEPSS 2%

    idreamsoft · icmsApr 29, 2021

  • CVE-2018-16366
    35Monitor

    An issue was discovered in idreamsoft iCMS V7.0.10.

    HighCVSS 8.8No exploitEPSS 1%

    idreamsoft · icmsSep 2, 2018

  • CVE-2018-16332
    35Monitor

    An issue was discovered in iCMS 7.0.9.

    HighCVSS 8.8No exploitEPSS 1%

    idreamsoft · icmsSep 1, 2018

  • CVE-2018-16365
    35Monitor

    An issue was discovered in idreamsoft iCMS V7.0.10.

    HighCVSS 8.8No exploitEPSS 1%

    idreamsoft · icmsSep 2, 2018

  • CVE-2020-21141
    35Monitor

    iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.

    HighCVSS 8.8No exploitEPSS 1%

    idreamsoft · icmsNov 12, 2021

  • CVE-2020-26641
    35Monitor

    A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts

    HighCVSS 8.8No exploitEPSS 1%

    idreamsoft · icmsMay 28, 2021

  • CVE-2023-40953
    35Monitor

    icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).

    HighCVSS 8.8No exploitEPSS 0%

    idreamsoft · icmsSep 7, 2023

  • CVE-2019-7235
    31Monitor

    An issue was discovered in idreamsoft iCMS 7.0.13.

    HighCVSS 7.5No exploitEPSS 2%

    idreamsoft · icmsJan 30, 2019

  • CVE-2019-7237
    31Monitor

    An issue was discovered in idreamsoft iCMS 7.0.13 on Windows.

    HighCVSS 7.5No exploitEPSS 2%

    idreamsoft · icmsJan 30, 2019

  • CVE-2019-7236
    31Monitor

    An issue was discovered in idreamsoft iCMS 7.0.13.

    HighCVSS 7.5No exploitEPSS 2%

    idreamsoft · icmsJan 30, 2019

  • CVE-2021-44977
    30Monitor

    In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.

    HighCVSS 7.5No exploitEPSS 2%

    idreamsoft · icmsFeb 4, 2022

  • CVE-2019-17583
    30Monitor

    idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonst

    HighCVSS 7.5No exploitEPSS 1%

    idreamsoft · icmsOct 14, 2019

  • CVE-2018-16320
    29Monitor

    idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.

    HighCVSS 7.2No exploitEPSS 2%

    idreamsoft · icmsSep 1, 2018

  • CVE-2019-16677
    26Monitor

    An issue was discovered in idreamsoft iCMS V7.0.

    MediumCVSS 6.5No exploitEPSS 0%

    idreamsoft · icmsSep 21, 2019

  • CVE-2020-24739
    26Monitor

    A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account.

    MediumCVSS 6.5No exploitEPSS 0%

    idreamsoft · icmsSep 10, 2020

  • CVE-2018-13865
    24Monitor

    An issue was discovered in idreamsoft iCMS 7.0.9.

    MediumCVSS 6.1No exploitEPSS 1%

    idreamsoft · icmsJul 10, 2018