CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 緊急9.8 |
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function. |
| 10/08/2023 |
| CVE-2023-39805 | 緊急9.8 | iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php. | 10/08/2023 |
| CVE-2022-41496 | 緊急9.8 | iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php. | 13/10/2022 |
| CVE-2021-44978 | 緊急9.8 | iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. | 04/02/2022 |
| CVE-2021-44977 | 高7.5 | In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. | 04/02/2022 |
| CVE-2020-21141 | 高8.8 | iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add. | 12/11/2021 |
| CVE-2020-26641 | 高8.8 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts. | 28/05/2021 |
| CVE-2020-18070 | 緊急9.1 | Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php". | 30/04/2021 |
| CVE-2020-19527 | 緊急9.8 | iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php. | 10/12/2020 |
| CVE-2020-19142 | 緊急9.8 | iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php. | 10/12/2020 |
| CVE-2020-24739 | 中6.5 | A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all administrators except the initial administrator will be deleted. | 10/09/2020 |
| CVE-2019-17583 | 高7.5 | idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer. | 14/10/2019 |
| CVE-2019-17552 | 緊急9.8 | An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload. | 14/10/2019 |
| CVE-2019-16677 | 中6.5 | An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. | 21/09/2019 |
| CVE-2019-11427 | 中6.1 | An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter. | 22/04/2019 |
| CVE-2019-11426 | 中6.1 | An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter. | 22/04/2019 |
| CVE-2019-8902 | 中5.7 | An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI. | 18/02/2019 |