yxcms records
5 published records for vendor yxcms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-732 Incorrect Permission Assignment for Critical Resource1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
30Monitor | CVE-2018-8761No exploit | protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attyxcms · yxcms | High7.5 | — | 0.8% | Mar 19, 2018 |
28Monitor | CVE-2018-19404No exploit | In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code byyxcms · yxcms · CWE-94 | High7.2 | — | 1.5% | Nov 20, 2018 |
26Monitor | CVE-2018-11003No exploit | An issue was discovered in YXcms 1.4.7.yxcms · yxcms · CWE-352 | Medium6.5 | — | 0.6% | May 12, 2018 |
24Monitor | CVE-2018-8805No exploit | Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestboyxcms · yxcms · CWE-79 | Medium6.1 | — | 0.6% | Mar 20, 2018 |
19Monitor | CVE-2018-13025No exploit | protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admyxcms · yxcms · CWE-732 | Medium4.9 | — | 0.8% | Jun 29, 2018 |
- CVE-2018-876130Monitor
protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing att
HighCVSS 7.5No exploitEPSS 0%yxcms · yxcmsMar 19, 2018
- CVE-2018-1940428Monitor
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by
HighCVSS 7.2No exploitEPSS 1%yxcms · yxcmsNov 20, 2018
- CVE-2018-1100326Monitor
An issue was discovered in YXcms 1.4.7.
MediumCVSS 6.5No exploitEPSS 0%yxcms · yxcmsMay 12, 2018
- CVE-2018-880524Monitor
Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbo
MediumCVSS 6.1No exploitEPSS 0%yxcms · yxcmsMar 20, 2018
- CVE-2018-1302519Monitor
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=adm
MediumCVSS 4.9No exploitEPSS 0%yxcms · yxcmsJun 29, 2018