Skip to content
Noroxi

QiboSoft records

14 published records for vendor qibosoft.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 23
  5. 24
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

14 records
  • CVE-2019-17613
    40Plan

    qibosoft 7 allows remote code execution because do/jf.php makes eval calls.

    CriticalCVSS 9.8No exploitEPSS 2%

    qibosoft · qibosoftOct 15, 2019

  • CVE-2024-1225
    39Monitor

    QiboSoft QiboCMS X1 Pay.php rmb_pay deserialization

    CriticalCVSS 9.8No exploitEPSS 0%

    qibosoft · qibocms x1Feb 5, 2024

  • CVE-2020-20944
    37Monitor

    An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.

    CriticalCVSS 9.1No exploitEPSS 2%

    qibosoft · qibosoftDec 27, 2021

  • CVE-2023-27037
    35Monitor

    Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php

    HighCVSS 8.8No exploitEPSS 1%

    qibosoft · qibocmsMar 16, 2023

  • CVE-2020-20945
    35Monitor

    A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add admi

    HighCVSS 8.8No exploitEPSS 0%

    qibosoft · qibosoftDec 27, 2021

  • CVE-2018-18201
    35Monitor

    qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.

    HighCVSS 8.8No exploitEPSS 0%

    qibosoft · qibosoftOct 9, 2018

  • CVE-2019-5725
    30Monitor

    qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a UR

    HighCVSS 7.5No exploitEPSS 1%

    qibosoft · qibosoftJan 8, 2019

  • CVE-2025-22973
    30Monitor

    An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application

    HighCVSS 7.5No exploitEPSS 0%

    qibosoft · qibocms x1Feb 20, 2025

  • CVE-2021-27811
    28Monitor

    A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0.

    HighCVSS 7.2No exploitEPSS 1%

    qibosoft · qibosoftMay 21, 2021

  • CVE-2011-1064
    27Monitor

    SQL injection vulnerability in member/list.php in qibosoft Qi Bo CMS 7 allows remote attackers to execute arbitrary SQL commands via the aid

    MediumCVSS 6.8No exploitEPSS 1%

    qibosoft · qi bo cmsFeb 22, 2011

  • CVE-2020-18022
    24Monitor

    Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive informat

    MediumCVSS 6.1No exploitEPSS 1%

    qibosoft · qibocmsApr 28, 2021

  • CVE-2020-20808
    24Monitor

    Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd a

    MediumCVSS 6.1No exploitEPSS 0%

    qibosoft · qibosoftAug 2, 2023

  • CVE-2020-20946
    21Monitor

    Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.

    MediumCVSS 5.4No exploitEPSS 0%

    qibosoft · qibosoftDec 27, 2021

  • CVE-2020-20943
    17Monitor

    A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arb

    MediumCVSS 4.3No exploitEPSS 0%

    qibosoft · qibosoftDec 27, 2021