Chshcms

chshcms

53 CVEs • 3 products

Products (3)

Click to collapse

Toggle

Cscms Music Portal System

cscms_music_portal_system

CVEs (53)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-28103 1Chshcms 1Cscms Nov 21, 2024 Jan 11, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 cscms v4.1 allows for SQL injection via the "page_del" function.
CVE-2020-28102 1Chshcms 1Cscms Nov 21, 2024 Jan 11, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 cscms v4.1 allows for SQL injection via the "js_del" function.
CVE-2020-21238 1Chshcms 1Cscms Nov 21, 2024 Dec 27, 2021 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
CVE-2020-22848 1Chshcms 1Cscms Nov 21, 2024 Aug 30, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.
CVE-2019-9598 1Chshcms 1Cscms Nov 21, 2024 Mar 7, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.
CVE-2019-6779 1Chshcms 1Cscms Nov 21, 2024 Jan 24, 2019 N/A· v4 8.1 HIGH· v3 5.8 MEDIUM· v2 Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
CVE-2018-17126 1Chshcms 1Cscms Nov 21, 2024 Sep 17, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.
CVE-2018-17125 1Chshcms 1Cscms Nov 21, 2024 Sep 17, 2018 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.
CVE-2018-16732 1Chshcms 1Cscms Nov 21, 2024 Sep 8, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 \upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
CVE-2018-16731 1Chshcms 1Cscms Nov 21, 2024 Sep 8, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JSON data.
CVE-2018-16730 1Chshcms 1Cscms Nov 21, 2024 Sep 8, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 \upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
CVE-2018-16448 1Chshcms 1Cscms Nov 21, 2024 Sep 4, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web edit...Show more Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save.Show less
CVE-2018-16337 1Chshcms 1Cscms Nov 21, 2024 Sep 2, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save.