CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 22/07/2018 |
| CVE-2018-14389 | KRITISCH9.8 | joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter. | 18/07/2018 |
| CVE-2018-14388 | MITTEL5.4 | joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter. | 18/07/2018 |
| CVE-2018-14334 | KRITISCH9.8 | manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766. | 17/07/2018 |
| CVE-2018-12905 | MITTEL6.1 | joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions. | 27/06/2018 |
| CVE-2018-12039 | KRITISCH9.8 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring. | 07/06/2018 |
| CVE-2018-10096 | MITTEL4.8 | joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. | 13/04/2018 |
| CVE-2018-10073 | MITTEL4.8 | joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. | 12/04/2018 |
| CVE-2018-10028 | MITTEL5.3 | joyplus-cms 1.6.0 allows remote attackers to obtain sensitive information via a direct request to the install/ or log/ URI. | 11/04/2018 |
| CVE-2018-8767 | MITTEL4.8 | joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter. | 18/03/2018 |
| CVE-2018-8766 | KRITISCH9.8 | joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add. | 18/03/2018 |
| CVE-2018-8717 | HOCH8.8 | joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. | 15/03/2018 |