Skip to content
Noroxi

lfdycms records

5 published records for vendor lfdycms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

5 records
  • CVE-2018-12603
    36Monitor

    Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecif

    HighCVSS 8.8Proof of conceptEPSS 3%

    lfdycms · lfcmsJun 25, 2018

  • CVE-2018-12602
    36Monitor

    A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily.

    HighCVSS 8.8Proof of conceptEPSS 3%

    lfdycms · lfcmsJun 25, 2018

  • CVE-2018-20603
    35Monitor

    Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.

    HighCVSS 8.8No exploitEPSS 1%

    lfdycms · lei feng tv cmsDec 30, 2018

  • CVE-2018-20602
    30Monitor

    Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.

    HighCVSS 7.5No exploitEPSS 1%

    lfdycms · lei feng tv cmsDec 30, 2018

  • CVE-2018-20604
    19Monitor

    Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin

    MediumCVSS 4.9No exploitEPSS 1%

    lfdycms · lei feng tv cmsDec 30, 2018