CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2023-39806 | 심각9.8 | iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function. | 10/08/2023 |
| CVE-2023-39805 | 심각9.8 | iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php. | 10/08/2023 |
| CVE-2022-41496 | 심각9.8 | iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php. | 13/10/2022 |
| CVE-2021-44978 | 심각9.8 | iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. | 04/02/2022 |
| CVE-2021-44977 | 높음7.5 | In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. | 04/02/2022 |
| CVE-2020-21141 | 높음8.8 | iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add. | 12/11/2021 |
| CVE-2020-26641 | 높음8.8 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts. | 28/05/2021 |
| CVE-2020-18070 | 심각9.1 | Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php". | 30/04/2021 |
| CVE-2020-19527 | 심각9.8 | iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php. | 10/12/2020 |
| CVE-2020-19142 | 심각9.8 | iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php. | 10/12/2020 |
| CVE-2020-24739 | 보통6.5 | A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all administrators except the initial administrator will be deleted. | 10/09/2020 |
| CVE-2019-17583 | 높음7.5 | idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer. | 14/10/2019 |
| CVE-2019-17552 | 심각9.8 | An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload. | 14/10/2019 |
| CVE-2019-16677 | 보통6.5 | An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. | 21/09/2019 |
| CVE-2019-11427 | 보통6.1 | An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter. | 22/04/2019 |
| CVE-2019-11426 | 보통6.1 | An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter. | 22/04/2019 |
| CVE-2019-8902 | 보통5.7 | An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI. | 18/02/2019 |