İçeriğe atla
Noroxi

gxlcms kayıtları

gxlcms üreticisine ait 15 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
3
Düzeltme kaydı olan
%0
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 18
  3. 21

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

15 kayıt
  • CVE-2018-9848
    40Planlayın

    In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP

    KritikCVSS 9,8İstismar yokEPSS %2

    gxlcms · gxlcms qy7 Nis 2018

  • CVE-2018-14685
    40Planlayın

    The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a craf

    KritikCVSS 9,8İstismar yokEPSS %2

    gxlcms · gxlcms28 Tem 2018

  • CVE-2018-9247
    39İzleyin

    The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL sta

    KritikCVSS 9,8İstismar yokEPSS %1

    gxlcms · gxlcms qy3 Nis 2018

  • CVE-2018-9847
    39İzleyin

    In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP cod

    KritikCVSS 9,8İstismar yokEPSS %1

    gxlcms · gxlcms qy7 Nis 2018

  • CVE-2018-9852
    39İzleyin

    In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM cl

    KritikCVSS 9,8İstismar yokEPSS %1

    gxlcms · gxlcms qy7 Nis 2018

  • CVE-2020-20975
    39İzleyin

    In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.

    KritikCVSS 9,8İstismar yokEPSS %1

    gxlcms · gxlcms12 Ağu 2021

  • CVE-2018-18488
    39İzleyin

    In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.

    KritikCVSS 9,8İstismar yokEPSS %1

    gxlcms · gxlcms18 Eki 2018

  • CVE-2018-15177
    35İzleyin

    In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.

    YüksekCVSS 8,8İstismar yokEPSS %0

    gxlcms · gxlcms7 Ağu 2018

  • CVE-2018-9850
    31İzleyin

    In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequenc

    YüksekCVSS 7,5İstismar yokEPSS %1

    gxlcms · gxlcms qy7 Nis 2018

  • CVE-2018-9851
    31İzleyin

    In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admi

    YüksekCVSS 7,5İstismar yokEPSS %1

    gxlcms · gxlcms qy7 Nis 2018

  • CVE-2017-14979
    30İzleyin

    Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files

    YüksekCVSS 7,5İstismar yokEPSS %1

    gxlcms · gxlcms2 Eki 2017

  • CVE-2018-18487
    30İzleyin

    In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in pred

    YüksekCVSS 7,5İstismar yokEPSS %1

    gxlcms · gxlcms18 Eki 2018

  • CVE-2018-16436
    28İzleyin

    Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

    YüksekCVSS 7,2İstismar yokEPSS %1

    gxlcms · gxlcms5 Eyl 2018

  • CVE-2018-16655
    24İzleyin

    Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

    OrtaCVSS 6,1İstismar yokEPSS %0

    gxlcms · gxlcms7 Eyl 2018

  • CVE-2018-16437
    19İzleyin

    Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.

    OrtaCVSS 4,9İstismar yokEPSS %1

    gxlcms · gxlcms5 Eyl 2018