CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 14/09/2019 |
| CVE-2019-10708 | KRITISCH9.8 | S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter. | 02/04/2019 |
| CVE-2019-10237 | HOCH8.8 | S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040. | 27/03/2019 |
| CVE-2019-9925 | MITTEL6.1 | S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter. | 22/03/2019 |
| CVE-2019-9040 | HOCH8.8 | S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332. | 23/02/2019 |
| CVE-2019-6805 | KRITISCH9.8 | SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter. | 25/01/2019 |
| CVE-2018-20480 | KRITISCH9.8 | An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter. | 26/12/2018 |
| CVE-2018-20479 | KRITISCH9.8 | An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter. | 26/12/2018 |
| CVE-2018-20478 | HOCH7.5 | An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value. | 26/12/2018 |
| CVE-2018-20477 | KRITISCH9.8 | An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field. | 26/12/2018 |
| CVE-2018-20476 | MITTEL6.1 | An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter. | 26/12/2018 |
| CVE-2018-20018 | HOCH7.5 | S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI. | 10/12/2018 |
| CVE-2018-19332 | HOCH8.8 | An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI. | 17/11/2018 |
| CVE-2018-19331 | HOCH7.5 | An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter. | 17/11/2018 |
| CVE-2018-19145 | MITTEL6.1 | An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter. | 09/11/2018 |
| CVE-2018-18887 | KRITISCH9.8 | S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field). | 01/11/2018 |
| CVE-2018-18427 | KRITISCH9.8 | s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php. | 17/10/2018 |