Skip to content
Noroxi

phpmywind records

22 published records for vendor phpmywind.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

22 records
  • CVE-2020-21060
    35Monitor

    SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrato

    HighCVSS 8.8No exploitEPSS 1%

    phpmywind · phpmywindApr 4, 2023

  • CVE-2020-18885
    29Monitor

    Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/we

    HighCVSS 7.2No exploitEPSS 4%

    phpmywind · phpmywindAug 20, 2021

  • CVE-2021-39503
    29Monitor

    PHPMyWind 5.6 is vulnerable to Remote Code Execution.

    HighCVSS 7.2No exploitEPSS 3%

    phpmywind · phpmywindSep 7, 2021

  • CVE-2018-17134
    29Monitor

    admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cf

    HighCVSS 7.2No exploitEPSS 2%

    phpmywind · phpmywindSep 17, 2018

  • CVE-2018-17133
    29Monitor

    admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.

    HighCVSS 7.2No exploitEPSS 2%

    phpmywind · phpmywindSep 17, 2018

  • CVE-2018-17131
    29Monitor

    admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.

    HighCVSS 7.2No exploitEPSS 2%

    phpmywind · phpmywindSep 17, 2018

  • CVE-2018-17132
    29Monitor

    admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.

    HighCVSS 7.2No exploitEPSS 2%

    phpmywind · phpmywindSep 17, 2018

  • CVE-2020-18886
    29Monitor

    Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.

    HighCVSS 7.2No exploitEPSS 2%

    phpmywind · phpmywindAug 20, 2021

  • CVE-2020-21400
    28Monitor

    SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modi

    HighCVSS 7.2No exploitEPSS 1%

    phpmywind · phpmywindJun 20, 2023

  • CVE-2020-19964
    26Monitor

    A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator accou

    MediumCVSS 6.5No exploitEPSS 1%

    phpmywind · phpmywindOct 14, 2021

  • CVE-2017-12984
    25Monitor

    PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.

    MediumCVSS 6.1Proof of conceptEPSS 2%

    phpmywind · phpmywindAug 21, 2017

  • CVE-2019-7661
    24Monitor

    An issue was discovered in PHPMyWind 5.5.

    MediumCVSS 6.1No exploitEPSS 1%

    phpmywind · phpmywindMar 7, 2019

  • CVE-2019-7660
    24Monitor

    An issue was discovered in PHPMyWind 5.5.

    MediumCVSS 6.1No exploitEPSS 1%

    phpmywind · phpmywindMar 7, 2019

  • CVE-2019-16703
    24Monitor

    admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.

    MediumCVSS 6.1No exploitEPSS 1%

    phpmywind · phpmywindSep 23, 2019

  • CVE-2018-11487
    24Monitor

    PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.

    MediumCVSS 6.1No exploitEPSS 1%

    phpmywind · phpmywindMay 26, 2018

  • CVE-2019-7402
    24Monitor

    An issue was discovered in PHPMyWind 5.5.

    MediumCVSS 6.1No exploitEPSS 0%

    phpmywind · phpmywindFeb 5, 2019

  • CVE-2018-17130
    21Monitor

    PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,

    MediumCVSS 5.4No exploitEPSS 1%

    phpmywind · phpmywindSep 17, 2018

  • CVE-2019-7403
    20Monitor

    An issue was discovered in PHPMyWind 5.5.

    MediumCVSS 4.9No exploitEPSS 2%

    phpmywind · phpmywindFeb 5, 2019

  • CVE-2020-18230
    19Monitor

    Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg

    MediumCVSS 4.8No exploitEPSS 1%

    phpmywind · phpmywindMay 27, 2021

  • CVE-2020-18229
    19Monitor

    Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg

    MediumCVSS 4.8No exploitEPSS 1%

    phpmywind · phpmywindMay 27, 2021

  • CVE-2019-16704
    19Monitor

    admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.

    MediumCVSS 4.8No exploitEPSS 1%

    phpmywind · phpmywindSep 23, 2019

  • CVE-2019-8435
    19Monitor

    admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.

    MediumCVSS 4.8No exploitEPSS 1%

    phpmywind · phpmywindFeb 17, 2019