CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2018-17037 |
| 높음8.8 |
user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. |
| 14/09/2018 |
| CVE-2018-17036 | 심각9.8 | An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php. | 14/09/2018 |
| CVE-2018-17035 | 심각9.8 | UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. | 14/09/2018 |
| CVE-2018-17034 | 보통6.1 | UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. | 14/09/2018 |